by Kastro
Paper/Archive/CVE-2026-77549

CVE-2026-77549

Ubiquiti Inc UniFi OS Server — A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vuln…

EPSS 0.5%CVSS 9.0
critical.is priorityof 100
36
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 43.7.437 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Affected

ProductAffectedFixed inSource
UniFi OS Server< 5.1.375.1.37CNA
Cloud Keys< 5.1.315.1.31CNA
Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Attached Storage< 5.1.315.1.31CNA
Dream Machines< 5.1.315.1.31CNA
Enterprise Firewall Core< 5.1.315.1.31CNA
Dream Routers< 5.1.315.1.31CNA
Enterprise Fortress Gateway< 5.1.315.1.31CNA
Cloud Gateways< 5.1.315.1.31CNA
Dream Wall< 5.1.315.1.31CNA
Express 7< 5.1.315.1.31CNA

Scores by source

Ubiquiti (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9