Critical UniFi flaws demand immediate patching
Ubiquiti disclosed 22 critical UniFi vulnerabilities on 26 August 2026. All have CVSS scores of 8.2 to 10.0. Immediate updates are required.
Enterprises that depend on UniFi networking or video‑surveillance gear face a new wave of critical security flaws. On 26 August 2026 Ubiquiti disclosed 22 vulnerabilities across the UniFi product family, each scoring 8.2 to 10.0 on the Common Vulnerability Scoring System (CVSS).
Affected products, versions and CVEs
| Product | Vulnerable version | CVE | Type |
|---|---|---|---|
| UniFi Protect Application | 7.1.87 and earlier | CVE‑2026‑77533 | Command injection |
| UniFi Protect Application | 7.1.87 and earlier | CVE‑2026‑77537 | Command injection |
| UniFi Protect Application | 7.1.87 and earlier | CVE‑2026‑77548 | Command injection |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77534 | Privilege escalation |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77536 | Privilege escalation |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77539 | Command injection |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77540 | Command injection |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77545 | Privilege escalation |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77549 | Authentication bypass |
| UniFi OS Server | 5.1.21 and earlier | CVE‑2026‑77550 | Authentication bypass |
| UniFi Network Application | 10.4.57 and earlier | CVE‑2026‑77535 | Command injection |
| UniFi Network Application | 10.4.57 and earlier | CVE‑2026‑77541 | Privilege escalation |
| UniFi Connect Application | 3.24.20 and earlier | CVE‑2026‑77538 | Privilege escalation |
| UniFi Connect Display Cast Pro | 1.0.108 and earlier | CVE‑2026‑77551 | Privilege escalation |
| UniFi Enterprise Audio/Video Bridge | 1.0.10 and earlier | CVE‑2026‑77552 | Command injection |
| UniFi Access Application | 4.3.3 and earlier | CVE‑2026‑77543 | Command injection |
| UniFi Access Application | 4.3.3 and earlier | CVE‑2026‑77546 | Command injection |
| UniFi Access Application | 4.3.3 and earlier | CVE‑2026‑77547 | Command injection |
| UniFi Access Application | 4.3.3 and earlier | CVE‑2026‑77553 | Privilege escalation |
| UniFi Talk Application | 5.2.7 and earlier | CVE‑2026‑77554 | Command injection |
| UID Enterprise Agent | 1.61.8 and earlier | CVE‑2026‑77542 | Command injection |
| UniFi Protect AI Key | 2.1.3 and earlier | CVE‑2026‑77557 | Privilege escalation |
Photo by Christina Morillo on Pexels
Remediation steps
1. Identify every UniFi device running a version listed above.
2. Plan a maintenance window that minimises user impact.
3. Apply the fixes by updating each product to the version specified in Ubiquiti’s advisory.
4. Verify the update, check the firmware version in the device UI or via the command‑line.
5. Monitor logs for unexpected remote connections or privilege‑escalation attempts, especially on devices that could not be patched immediately.
As a Ubiquiti Partner, Stratum recommends applying these updates without delay to keep your network secure.
Terms used in this article
- CVE, Common Vulnerabilities and Exposures, a public identifier for a security flaw.
- CVSS, Common Vulnerability Scoring System, a numeric rating from 0 to 10 that reflects severity.
- Command injection, a bug that lets an attacker run arbitrary commands on a device.
- Privilege escalation, a bug that lets a low‑privilege user obtain higher rights.
- Authentication bypass, a bug that lets an attacker log in without valid credentials.
- CRLF, carriage‑return line‑feed characters that can be abused to alter request handling.
