by Kastro
Paper/Archive/CVE-2026-77550

CVE-2026-77550

Ubiquiti Inc UniFi OS Server — A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain de…

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 56.6.566 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Affected

ProductAffectedFixed inSource
UniFi OS Server< 5.1.375.1.37CNA
Cloud Keys< 5.1.315.1.31CNA
Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Video Recorders< 5.1.315.1.31CNA
Enterprise Network Attached Storage< 5.1.315.1.31CNA
Dream Machines< 5.1.315.1.31CNA
Enterprise Firewall Core< 5.1.315.1.31CNA
Dream Routers< 5.1.315.1.31CNA
Enterprise Fortress Gateway< 5.1.315.1.31CNA
Cloud Gateways< 5.1.315.1.31CNA
Dream Wall< 5.1.315.1.31CNA
Express 7< 5.1.315.1.31CNA

Scores by source

Ubiquiti (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9