Three 10.0 security flaws fixed across Ubiquiti’s UniFi line
Ubiquiti patches 22 UniFi vulnerabilities, 21 rated critical including three CVSS 10.0 flaws enabling unauthorized access.
Ubiquiti disclosed and patched 22 vulnerabilities, 21 rated critical and three assigned the maximum CVSS 10.0 score: CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554. All three involve improper access control that could let attackers gain privileges, while other flaws permit authentication bypass or arbitrary command execution. All but one of the 22 affect the UniFi product line. The company did not confirm whether any were exploited before patching.
- Three CVSS 10.0 flaws: CVE-2026-77537, -77550, -77554
- 21 of 22 flaws rated critical; one rated high
- Improper access control affects at least 8 vulnerabilities
- CISA added three Ubiquiti flaws to KEV earlier this year
- Vendors
- Ubiquiti
- Products
- UniFi
- Organizations
- CISACyberScoop
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77537 | Command Injection in Ubiquiti UniFi Protect Application | 10.0 | <1% | ||
| CVE-2026-77550 | Authentication Bypass via CRLF Injection in Ubiquiti UniFi OS | 10.0 | <1% | ||
| CVE-2026-77554 | Unauthenticated Command Injection in Ubiquiti UniFi Talk Application | 10.0 | <1% |
From the original article
2 min read at cyberscoop.com
The communications product company disclosed 22 total Wednesday, all but one of which was rated “critical” at 9. 0 or higher. The UniFi brand logo on March 5, 2026.
By @timstarks · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.