Full research report

Ubiquiti patches three max severity security vulnerabilities

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

Ubiquiti's 26 August 2026 patch release addresses three maximum-severity vulnerabilities spanning its video surveillance, operating system, and VoIP product lines, all of which can be exploited by unauthenticated network-adjacent or remote attackers without user interaction. These three CVEs sit within a same-day disclosure of 21 critical-to-maximum-severity issues across the broader UniFi ecosystem, continuing a pronounced pattern of high-severity advisories throughout 2026. No exploitation in the wild or public proof-of-concept has been confirmed for the August CVEs, but with over 100,000 UniFi OS instances indexed by Censys and a well-documented history of APT28 weaponising Ubiquiti hardware for espionage—plus CISA's June 2026 Known Exploited Vulnerabilities additions for prior UniFi OS flaws—the risk of rapid weaponisation is credible. Defenders should prioritise patching internet-exposed instances and restrict management interfaces to trusted network segments while awaiting independent technical analysis.

What happened

On 26 August 2026, Ubiquiti issued patches for three maximum-severity vulnerabilities spanning its UniFi video surveillance platform, operating system authentication layer, and VoIP phone system. All three carry CVSS 10.0 and are exploitable remotely by unauthenticated attackers without user interaction. The release is part of a broader same-day disclosure of 21 critical-to-maximum-severity flaws across the wider UniFi ecosystem. Ubiquiti has not indicated pre-patch exploitation of any of the three specific CVEs.

Affected scope

CVE-2026-77537 affects UniFi Protect Application prior to version 7.2.105 (video surveillance management). CVE-2026-77550 affects UniFi OS devices and instances below version 5.1.21. CVE-2026-77554 affects UniFi Talk Application prior to version 5.3.2 (VoIP). Censys records over 100,000 internet-exposed UniFi OS instances, though this figure may include honeypots and stale scan artefacts. Affected sectors include enterprise and SMB environments using Ubiquiti gear for network management, physical access control, and communications.

Technical assessment

CVE-2026-77537 is an improper input validation flaw (CWE-20) in UniFi Protect enabling unauthenticated network-accessible attackers to execute commands on the host; its CVSS vector includes a changed scope, indicating impact extends beyond the directly vulnerable component. CVE-2026-77550 exploits improper neutralisation of CRLF sequences within UniFi OS to bypass authentication, granting unauthenticated access to protected functions. CVE-2026-77554 is a command injection flaw in UniFi Talk arising from inadequate input sanitisation in the VoIP subsystem. Taken together, the three vulnerabilities cover surveillance, OS-level access control, and communications layers of a typical Ubiquiti deployment, representing a broad, layered attack surface for any network-positioned adversary.

Recommended defensive actions

  1. Update UniFi Protect Application to version 7.2.105 or later as a priority.
  2. Update UniFi Talk Application to version 5.3.2 or later.
  3. Update UniFi OS Server to version 5.1.21 or later.
  4. Audit all internet-facing UniFi OS instances and restrict management interfaces to trusted networks or VPN access only.
  5. Monitor UniFi devices for unexpected authentication events, new administrator account creation, or anomalous outbound connections.
  6. Subscribe to Ubiquiti Security Advisory Bulletins to receive timely notification of future disclosures.

Uncertainties and evidence gaps

  • Ubiquiti has not confirmed whether any of the three CVEs were exploited before patches were released.
  • The fixed version for UniFi OS Server is ambiguously reported by BleepingComputer as '5.1.21 and earlier', likely an editorial error; defenders should verify against the official community advisory bulletin directly.
  • Censys exposure data may overstate the real-world attack surface through inclusion of honeypots and stale scan results.
  • No independent security researcher has published a technical analysis or proof-of-concept for these CVEs at time of writing.
  • The precise relationship between the three max-severity CVEs and the 18 additional critical flaws disclosed the same day is not fully articulated in available reporting.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated attacker with network access to the affected device or service
ComponentUniFi Protect Application (video surveillance management), UniFi OS authentication layer, UniFi Talk Application (VoIP)
MechanismImproper input validation (CWE-20) enabling command injection in UniFi Protect and UniFi Talk; failure to neutralise CRLF sequences enabling authentication bypass in UniFi OS
ImpactFull host compromise on video surveillance and VoIP systems; authentication bypass enabling unauthorised access to UniFi OS-managed devices
DetectionUnexpected authentication successes or new administrator accounts on UniFi devices; anomalous outbound connections or API calls to Protect or Talk services; unusual process execution on UniFi OS hosts
MitigationApply vendor patches: UniFi Protect Application 7.2.105+, UniFi Talk Application 5.3.2+, UniFi OS Server 5.1.21+
Exploitation status

No confirmed active exploitation in the wild; Ubiquiti has not disclosed any pre-patch exploitation, though all three flaws carry CVSS 10.0 and require no authentication or user interaction.

Research process

Research began by fetching the BleepingComputer report to establish the three CVEs, affected products, and fixed versions, then used search to identify independent corroborating coverage. CybersecurityNews confirmed the three CVEs sit within a broader 21-flaw August 26 disclosure and supplied a full CVE table. The OffSeq threat radar independently confirmed the CVSS 10.0 vector for CVE-2026-77537. The Hacker News provided threat actor context, confirming CISA had already added earlier 2026 UniFi OS flaws to its Known Exploited Vulnerabilities catalogue and documenting APT28's prior use of Ubiquiti devices for espionage. No public proof-of-concept was found for the August CVEs, and the official Ubiquiti community advisory pages could not be directly retrieved due to JavaScript rendering.

  1. What do the three CVEs cover and which products are affected?
    Fetched the BleepingComputer primary report on the three max-severity patches
    bleepingcomputer.com ↗

    CVE-2026-77537 is improper input validation in UniFi Protect (fixed 7.2.105+); CVE-2026-77550 is CRLF injection in UniFi OS enabling authentication bypass (fixed 5.1.21+); CVE-2026-77554 is command injection in UniFi Talk (fixed 5.3.2+); over 100,000 internet-exposed UniFi OS instances per Censys; no exploitation confirmed.

    why Established the baseline event, affected products, fixed versions, and internet exposure scale from the primary source.

  2. Are the CVE IDs confirmed by independent sources and what broader disclosure context exists?
    Searched for all three CVE IDs combined to locate independent coverage

    Multiple outlets including CybersecurityNews and SC Media confirmed the three CVE identifiers; the August 26 disclosure encompassed 21 critical and max-severity issues across the UniFi ecosystem, not just the three highlighted CVEs.

    why Established independent corroboration and confirmed the three CVEs are part of a larger coordinated same-day disclosure.

  3. What is the full scope of the 21-flaw disclosure and what CVSS scores apply?
    Fetched CybersecurityNews article on all 21 critical UniFi flaws
    cybersecuritynews.com ↗

    Full table of 21 CVEs (CVE-2026-77533 through CVE-2026-77557) spanning UniFi Protect, OS, Network, Access, Connect, Talk and enterprise audio/video products; CVSS scores 8.2–10.0; no confirmed exploitation for any entry.

    why Confirmed that the three target CVEs are part of a cluster of August 2026 disclosures sharing the same exploitation prerequisites, and that no in-the-wild activity has been reported across the full set.

  4. Can the CVSS score and weakness classification for CVE-2026-77537 be independently verified?
    Fetched the OffSeq Threat Radar record for CVE-2026-77537
    radar.offseq.com ↗

    CVSS 10.0 independently confirmed; full vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-20; publication date 26 August 2026; no PoC or exploitation data present.

    why Independent confirmation of maximum severity and scope-changed impact strengthened the assessment of critical exposure with no mitigating factors in the attack vector.

  5. Can the official Ubiquiti advisory bulletin be read to verify fixed versions directly?
    Fetched Ubiquiti Community Security Advisory Bulletin 066
    community.ui.com ↗

    Page returned a JavaScript loading screen with no extractable content; direct verification of vendor advisory text was not possible.

    why Fixed version information for the JSON report therefore relies on journalist reporting rather than the primary vendor advisory; this gap is recorded as a material uncertainty.

  6. Is any public proof-of-concept or exploit code available for the three CVEs?
    Searched for PoC or exploit references for CVE-2026-77537 and CVE-2026-77554

    No public proof-of-concept or exploit code found for any of the three August 2026 CVEs at time of research.

    why Absence of public PoC reduces immediate weaponisation risk but does not eliminate it given CVSS 10.0 ratings and low attack complexity across all three flaws.

  7. What is the historical threat actor pattern for Ubiquiti product exploitation and does CISA track related flaws?
    Fetched The Hacker News article on the July 2026 Ubiquiti patch batch for contextual threat actor and CISA KEV history
    thehackernews.com ↗

    CISA added three prior UniFi OS flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) to its Known Exploited Vulnerabilities catalogue in June 2026; APT28 (GRU) used the Moobot botnet deployed on Ubiquiti Edge OS routers for espionage until a February 2024 FBI operation (Operation Dying Ember) dismantled it.

    why Confirms a credible and recent pattern of nation-state and cybercriminal targeting of Ubiquiti products, elevating the threat model for unpatched August 2026 deployments beyond purely theoretical risk.

  8. Is the APT28 Moobot botnet disruption corroborated by additional sources?
    Searched for FBI Moobot Ubiquiti botnet disruption 2024 and CISA KEV UniFi context

    BleepingComputer, SC Media and search results collectively confirm the February 2024 FBI dismantling of the GRU-linked Moobot botnet on Ubiquiti Edge OS routers, and CISA KEV additions for prior 2026 UniFi OS flaws.

    why Multi-source corroboration of the historical exploitation pattern supports treating the August 2026 CVEs as high-priority based on demonstrated adversarial interest in the platform, not merely CVSS score alone.

Named in this story
ActorsAPT28 (GRU-linked, historical Ubiquiti exploitation)unnamed cybercriminals (historical botnet operators)
MalwareMoobot
TargetsUniFi Protect Application deployments (video surveillance)UniFi OS devices and instancesUniFi Talk Application users (VoIP)Enterprise and SMB network operators running UniFi infrastructureInternet-exposed UniFi OS management interfaces
Related CVEs CVE-2026-77537CVE-2026-77550CVE-2026-77554

Research coverage

All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 67 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok10 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1682 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok12 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 8 opened outside the registered collection
References & evidence
Vendor & gov advisories1
CVE-2026-77537: CWE-20 Improper Input Validation in Ubiquiti UniFi Protect Application – OffSeq Threat Radar radar.offseq.com ↗

Independently confirms CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-20 classification for CVE-2026-77537

Analysis & research3
Ubiquiti patches three max severity security vulnerabilities – BleepingComputer bleepingcomputer.com ↗

Primary report establishing all three CVEs, affected products, fixed versions, and Censys exposure data

21 Critical Ubiquiti UniFi Flaws Enable Authentication Bypass, Command Injection and Privilege Escalation – CybersecurityNews cybersecuritynews.com ↗

Full table of 21 CVEs in the August 26 disclosure with CVSS scores across all affected UniFi product lines

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS – The Hacker News thehackernews.com ↗

July 2026 batch context; confirms CISA added prior UniFi OS flaws to KEV catalogue and documents APT28 MooBot botnet disruption