Ubiquiti has released a sweeping set of security fixes for 21 critical vulnerabilities affecting much of its UniFi ecosystem. The affected technology spans network management, video surveillance, access control, communications, gateways and specialist devices, creating a broad patching challenge for organizations that have standardized on the platform.

The vulnerabilities carry CVSS scores between 8.2 and 10.0. Many can be reached over a network, and several can be chained to bypass authentication, execute operating-system commands or elevate a low-privileged user to administrator control. Although the latest disclosure does not establish active exploitation of these specific bugs, earlier UniFi OS flaws were exploited and later placed in CISA’s Known Exploited Vulnerabilities catalog.

Command injection dominates the disclosure

A large part of the batch involves inadequate validation of attacker-controlled input. In the most serious cases, a crafted request can cross the boundary between application data and operating-system commands, allowing an adversary to take control of the host device.

UniFi Protect, the video-surveillance application, includes CVE-2026-77537, a maximum-severity 10.0 flaw that requires no privileges. CVE-2026-77533 affects the same product and requires only low-level network access. Ubiquiti addressed both in UniFi Protect 7.2.105.

Related command-injection issues affect UniFi OS Server, the UniFi Network and Access applications, UniFi Talk, the UID Enterprise Agent and the Enterprise Audio/Video Bridge. A flaw in UniFi Talk also received a 10.0 score. The breadth means administrators cannot assume that updating only a controller or gateway completes the job.

Authentication bypass and privilege escalation

Two flaws, CVE-2026-77549 and CVE-2026-77550, involve improper handling of carriage-return and line-feed sequences. A network attacker may use them to get around login controls, with CVE-2026-77550 receiving the highest possible severity rating.

Other weaknesses allow users with limited access to gain administrative control of UniFi OS devices. The impacted families include Cloud Keys, network video recorders, NAS systems, Dream Machines, Dream Routers, Enterprise Fortress Gateways and Cloud Gateways. Additional escalation paths touch UniFi Connect, Display Cast Pro, Access and the Protect AI Key.

These outcomes are especially concerning in converged environments. A compromised UniFi console may provide visibility or control over switches and wireless networks, security cameras, doors or voice systems. An attacker who chains an authentication flaw with command execution could turn a management appliance into a durable foothold.

Versions administrators should verify

Ubiquiti’s fixes are distributed across multiple product-specific releases. Key targets include UniFi Protect 7.2.105, UniFi OS Server 5.1.37, UniFi Network 10.5.67, UniFi Access 4.3.5, UniFi Talk 5.3.2 and UniFi Connect 3.24.22.

The UID Enterprise Agent should be updated to 1.62.1, Display Cast Pro to 1.0.111, the Enterprise Audio/Video Bridge to 1.0.11 and Protect AI Key to 2.2.6. Hardware appliances do not all share one fixed firmware number, so teams should consult the vendor’s advisory for the build assigned to each device family rather than applying a single version assumption across the fleet.

Priorities for defenders

• Create an inventory covering controllers, applications and edge devices, not only visible routers and access points.
• Remove management interfaces from direct internet exposure and limit administration to trusted networks or a secured access path.
• Apply the relevant update to every product and verify the running version after reboot or redeployment.
• Use multifactor authentication where available, while recognizing that MFA does not substitute for fixing an authentication-bypass bug.
• Review administrative sessions, newly created accounts, configuration exports and unexpected processes for signs of compromise.

Managed service providers should pay particular attention because a shared management plane can amplify the consequences across customers. Network segmentation can reduce the ability of a compromised device to reach sensitive workloads, while centralized logging can help identify abnormal administrative activity.

With several flaws requiring little more than network reachability, delay creates unnecessary exposure. The safest response is a coordinated update campaign followed by a review of logs and configurations from the vulnerable period. UniFi’s automatic update capabilities may help some deployments, but security teams should verify completion rather than infer it.