by Kastro
Paper/Archive/CVE-2026-77536

CVE-2026-77536

Ubiquiti Inc UniFi OS Server — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain d…

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 36.1.361 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected

ProductAffectedFixed inSource
UniFi OS Server< 5.1.375.1.37CNA
Cloud Keys< 5.1.315.1.31CNA
Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Attached Storage< 5.1.315.1.31CNA
Dream Machines< 5.1.315.1.31CNA
Enterprise Firewall Core< 5.1.315.1.31CNA
Dream Routers< 5.1.315.1.31CNA
Enterprise Fortress Gateway< 5.1.315.1.31CNA
Cloud Gateways< 5.1.315.1.31CNA
Dream Wall< 5.1.315.1.31CNA
Express 7< 5.1.315.1.31CNA

Scores by source

Ubiquiti (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9