GoKawiilUbiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges.
The first (tracked as CVE-2026-77537) lets unauthenticated attackers compromise unpatched devices by exploiting an improper input validation weakness in the UniFi Protect Application video surveillance management platform.
Ubiquiti also addressed a CRLF injection flaw (CVE-2026-77550) that remote attackers without privileges can exploit to bypass authentication on UniFi OS devices or instances.
"A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running CRLF Injection to bypass authentication to such UniFi OS devices or instances," it explained.
The third maximum severity vulnerability patched today is a command injection security flaw (CVE-2026-77554) stemming from improper input validation in the UniFi Talk Application Voice over IP (VoIP) phone system.
The company addressed these flaws in UniFi Protect Application 7.2.105 or later, UniFi Talk Application 5.3.2 or later, and UniFi OS Server 5.1.21 and earlier.
Ubiquiti has yet to disclose whether any of these security vulnerabilities were exploited in the wild before patching, but shared that they can be exploited in low-complexity attacks that don't require user interaction.
On Thursday, Ubiquiti patched 18 more critical-severity security issues affecting a wide range of products, from the company's UniFi OS Server to the UniFi Network Application centralized network management platform, the UniFi Protect AI Key hardware edge-computing appliance, and a large selection of Ubiquiti routers, gateways, NAS, and surveillance systems.
Threat intelligence company Censys now tracks more than 100,000 UniFi OS instances exposed online, but there are no details on how many are honeypots or have already been secured against these security flaws. However, Censys data may also include historical scan results, which might not accurately reflect the number of Internet-exposed systems.
UniFi OS instances exposed on the Internet (Censys)
... continue reading