Latest Ubiquiti UniFi OS vulnerabilities #
Ubiquiti disclosed certain versions of UniFi OS are affected by multiple vulnerabilities:
- CVE-2026-77534: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges. The vulnerability has been designated CVE-2026-77534 and has been rated critical with a CVSS score of 9.9.
- CVE-2026-77536: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges. The vulnerability has been designated CVE-2026-77536 and has been rated critical with a CVSS score of 9.9.
- CVE-2026-77539: An improper input validation vulnerability that allows a remote, high-privileged attacker to execute arbitrary commands on the host device. The vulnerability has been designated CVE-2026-77539 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-77540: An improper input validation vulnerability that allows a remote, high-privileged attacker to execute arbitrary commands on the host device. The vulnerability has been designated CVE-2026-77540 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-77545: An active debug code vulnerability that allows a remote, low-privileged attacker under specific conditions to escalate privileges. The vulnerability has been designated CVE-2026-77545 and has been rated critical with a CVSS score of 9.0.
- CVE-2026-77549: An improper neutralization of CRLF sequences vulnerability that allows a remote, unauthenticated attacker under specific conditions to bypass authentication. The vulnerability has been designated CVE-2026-77549 and has been rated critical with a CVSS score of 9.0.
- CVE-2026-77550: An improper neutralization of CRLF sequences vulnerability that allows a remote, unauthenticated attacker under specific conditions to bypass authentication. The vulnerability has been designated CVE-2026-77550 and has been rated critical with a CVSS score of 10.0.
The following versions are affected
- UniFi OS Server: Versions 5.1.21 and prior
- Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: Versions 5.1.26 and prior
What is Ubiquiti UniFi OS? #
Ubiquiti UniFi OS is a Linux-based operating system and application server platform deployed across dedicated Cloud Gateways, hardware consoles, and self-hosted servers to manage and run individual network and security applications.
What is the impact? #
Successful exploitation of these vulnerabilities would allow a remote, unauthenticated or authenticated attacker with varying privilege levels to bypass authentication, escalate privileges, or execute arbitrary commands on the host system.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- UniFi OS Server: Upgrade to version 5.1.37 or later.
- Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: Upgrade to version 5.1.31 or later.
- Network Attached Storage: Upgrade to version 5.1.32 or later.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Ubiquiti UniFi OS"July 2026: Multiple CVE's #
Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi OS:
- CVE-2026-54401: A Server-Side Request Forgery (SSRF) vulnerability that allows a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54401 and has been rated high with a CVSS score of 7.7.
- CVE-2026-54402: An improper input validation vulnerability that allows a remote, low-privileged attacker to perform command injection on the host device. The vulnerability has been designated CVE-2026-54402 and has been rated critical with a CVSS score of 9.9.
- CVE-2026-54403: A path traversal vulnerability that allows a remote, low-privileged attacker to bypass authentication on UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54403 and has been rated high with a CVSS score of 8.6.
- CVE-2026-54404: A series of authenticated SQL Injection (SQLi) vulnerabilities that allow a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54404 and has been rated high with a CVSS score of 8.8.
- CVE-2026-55110: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability that allows a remote, unauthenticated attacker, who convinces an authenticated user to visit a malicious webpage, to trigger operations in UniFi OS using that user's session. The vulnerability has been designated CVE-2026-55110 and has been rated high with a CVSS score of 7.5.
- CVE-2026-55112: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device under certain conditions when UniFi OS is configured with the UniFi Protect Application. The vulnerability has been designated CVE-2026-55112 and has been rated high with a CVSS score of 7.5.
- CVE-2026-55116: An improper access control vulnerability that, under certain network configurations, allows a remote, unauthenticated attacker to make unauthorized changes to UniFi OS devices. The vulnerability has been designated CVE-2026-55116 and has been rated critical with a CVSS score of 9.0.
The following software versions are affected across their respective hardware platforms (including all standalone servers, UDM, UNAS, UCG, UCK, UNVR, ENVR, and EF consoles):
- UniFi OS / Server (Standard Consoles): Version 5.1.15 and prior.
- Applies to all reported CVEs (CVE-2026-54401 through CVE-2026-55116).
- Note on CVE-2026-55112: This risk only presents if the platform is running the UniFi Protect Application.
- UniFi Network Attached Storage (UNAS): Version 5.1.16 and prior.
- Applies to CVE-2026-54401, CVE-2026-54402, CVE-2026-54403, CVE-2026-54404, and CVE-2026-55110.
- Enterprise Firewall (EF-Core): Version 5.1.18 and prior.
- Applies to all reported CVEs.
Note on CVE-2026-54403: While the narrative text within the manufacturer's advisory suggests that chaining this path traversal flaw could allow an attacker to bypass the low-privilege threshold, the formal CVSS tracking metrics officially list the Privileges Required (PR) value as "None."
What is the impact? #
Successful exploitation of these vulnerabilities allows an adversary to bypass authentication, escalate privileges on the host device, and make unauthorized system or configuration changes.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- All Platforms: Upgrade to UniFi OS version 5.1.19 or later.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Ubiquiti UniFi OS"
