Three 10.0 security flaws fixed across Ubiquiti’s UniFi line

Ubiquiti's UniFi Talk Application contains an improper input validation flaw (CWE-20) that can be leveraged for command injection on the host device. The bug is triggered when untrusted input reaches the application over the network; per the CVSS vector, an attacker needs network reachability but no credentials, privileges, or user interaction (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields command execution on the underlying Talk host with high impact to confidentiality, integrity, and availability and a scope change, earning the maximum CVSS 3.1 score of 10.0. Any organization running the UniFi Talk Application is affected; this is one of three 10.0-rated flaws patched across Ubiquiti's UniFi line, although the available data does not list specific affected or fixed versions. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates a 1% probability of exploitation within 30 days.

Do: Update the UniFi Talk Application to the latest patched release published by Ubiquiti; the source data does not name the fixed version, so consult Ubiquiti's release notes for the patch released alongside the three 10.0-rated UniFi fixes. Restrict network access to the Talk Application to trusted management segments, since exploitation requires only network reachability with no authentication. Given the maximum-severity score and lack of public exploitation so far, prioritize patching internet-reachable deployments and monitor for emerging PoCs.

CVE-2026-77550 is an Improper Neutralization of CRLF (carriage return/line feed) sequences (CWE-93) in certain devices running Ubiquiti's UniFi OS, rated CVSS 10.0 with network reachability, no privileges, and no user interaction required. An attacker who can reach the vulnerable UniFi OS device or instance over the network sends crafted input containing CR/LF sequences, which disrupts authentication processing and lets the attacker bypass login entirely. Successful exploitation yields complete administrative control of the console or instance, with high impact on confidentiality, integrity, and availability, and the scope change in the CVSS vector indicates impact can extend beyond the vulnerable component to protected resources behind it. Any organization running an affected UniFi OS device is exposed, with the greatest risk for consoles or instances reachable from untrusted networks. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts near-term exploitation probability at about 0.5% (40th percentile); it is one of three 10.0-severity UniFi issues reported as fixed in recent updates.

Do: Apply the latest UniFi OS firmware/update release from Ubiquiti, which includes the fixes for this and the other two 10.0 flaws in the same advisory batch. Until patched, restrict network access to UniFi OS management interfaces (e.g., firewall rules or VPN-only access) and avoid exposing consoles directly to the internet. Check internet-facing UniFi OS instances for exposure and monitor for vendor advisories identifying specific affected/fixed versions.