Ubiquiti UniFi Protect, OS, and Talk – Critical Remote Exploitation Vulnerabilities | Arctic Wolf
Three CVSS 10.0 unauthenticated RCE and auth-bypass vulnerabilities in Ubiquiti UniFi Protect, OS, and Talk enable full remote takeover of exposed devices; patches are available but no workarounds exist. CVE-2026-77537 and CVE-2026-77554 are unauthenticated command injection flaws in UniFi Protect and UniFi Talk via improper input validation. CVE-2026-77550 is a CRLF injection in UniFi OS enabling authentication bypass across Dream Machine, Cloud Key, NVR, and Express 7 platforms. All three require no user interaction and grant full system control to network-reachable attackers.
Detection / Hunteropenrouter
Immediate Actions
- Patch UniFi Protect to 7.2.105+, UniFi OS Server to 5.1.37+, other OS to 5.1.31+, and Talk to 5.3.2+ immediately.
- Block all WAN-side access to UniFi management interfaces pending patch completion.
- Inventory all UniFi devices including backup and standby systems for vulnerable versions.
Key Takeaways
- All three CVEs carry CVSS v3.1 base score 10.0 with no authentication required.
- Patches were released by Ubiquiti on August 26, 2026, the same day as disclosure.
- No evidence of in-the-wild exploitation or public PoC code exists yet.
- Affected products include UniFi OS Server, Dream Machine, Cloud Key, NVRs, and Express 7.
- No vendor-endorsed workarounds exist; full patching is the only remediation.
Attack Chain
- Reconnaissance: Attacker identifies internet-exposed or network-reachable UniFi Protect, OS, or Talk devices
- Initial Access: Unauthenticated exploitation of CVE-2026-77537, CVE-2026-77550, or CVE-2026-77554 via network reach
- Execution: Command injection executes arbitrary commands on UniFi Protect or Talk (CVE-2026-77537, CVE-2026-77554)
- Defense Evasion: Authentication bypass via CRLF injection on UniFi OS grants attacker full control (CVE-2026-77550)
- Persistence: Full system control enables attacker to establish persistent access on compromised devices
Affected Systems
- UniFi Protect Application versions up to 7.2.104
- UniFi Talk Application versions prior to 5.3.2
- UniFi OS Server versions prior to 5.1.37
- UniFi OS on Cloud Key, NVR, Dream Machine, Express 7 prior to 5.1.31
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-77537 | UniFi Protect (up to 7.2.104) | Critical | Improper input validation enables unauthenticated remote command injection. |
| CVE-2026-77550 | UniFi OS (Server prior to 5.1.37; other platforms prior to 5.1.31) | Critical | CRLF injection permits unauthenticated remote authentication bypass. |
| CVE-2026-77554 | UniFi Talk (versions prior to 5.3.2) | Critical | Improper input validation enables unauthenticated remote command injection. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | UniFi devices are network appliances; EDR agents are typically not installed. |
| Network Visibility | Medium | Exploitation occurs over HTTP/HTTPS to management interfaces; NDR or firewall logs may capture anomalous requests. |
| Detection Difficulty | Hard | No PoC or exploit signatures exist; command injection may blend with legitimate management API traffic. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated HTTP requests containing CRLF characters or unexpected parameters targeting UniFi management interfaces indicate exploitation of CVE-2026-77550 or CVE-2026-77537 (T1190). | Firewall, reverse proxy, and UniFi app logs | Initial Access | Medium — legitimate API clients may send unusual parameters |
| Unexpected command execution or shell spawning on UniFi OS appliances following web management requests indicates successful command injection (T1059). | UniFi OS system logs, audit logs | Execution | Low — appliance firmware rarely spawns interactive shells |
Required Log Sources
- UniFi application logs
- Firewall WAN ingress logs
- Network flow data
- Reverse proxy or load balancer logs
- Authentication logs for UniFi OS
Key Behavioral Indicators
- HTTP requests to UniFi management API with embedded CRLF sequences
- Unauthenticated sessions gaining admin-level access on UniFi OS
- Unexpected shell or subprocess execution on UniFi appliances
- Management interface access from previously unseen source IPs
Control Gaps
- Network appliances lack EDR coverage for process-level telemetry
- No IDS signatures available for these CVEs
- Management interfaces exposed to internet bypass network segmentation
False Positive Assessment
Low — exploitation indicators on UniFi appliances are distinctive; unauthenticated admin access and CRLF sequences in management requests are anomalous.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate UniFi management interfaces on trusted VLANs with VPN-only access.
- Apply IP allowlisting to all UniFi web, UI, and API management paths.
- Enable automatic updates on UniFi devices where feasible.
User Protection
- Rotate all administrative passwords, SSH keys, and API tokens after patching.
- Enforce MFA on all UniFi management accounts.
Security Awareness
- Review patch management policies to ensure critical network appliance updates apply within 24 hours of disclosure.
MITRE ATT&CK Mapping
Initial Access
Execution
Privilege Escalation
Plain-Language Summary
Ubiquiti disclosed three critical security flaws in its UniFi networking and video products on August 26, 2026. An attacker on the network can take full control of affected devices without needing a password or any user action. Ubiquiti released fixes the same day, but there is no temporary workaround other than patching. Organizations should update all UniFi devices immediately and restrict internet access to management interfaces until patched.
- cveCVE-2026-77537Improper input validation enables unauthenticated remote command injection.
- cveCVE-2026-77550CRLF injection permits unauthenticated remote authentication bypass.
- cveCVE-2026-77554Improper input validation enables unauthenticated remote command injection.