Ubiquiti has recently addressed a series of 21 critical vulnerabilities affecting its UniFi product range. These security flaws, if exploited, could allow attackers with network access to bypass authentication, execute unauthorized commands, and gain full control over various devices including routers and cloud gateways.
Recent Security Advisory Details
The latest disclosure adds to previously identified vulnerabilities fixed earlier this year. The recent patch targets a wide array of UniFi products, emphasizing the continuing interest of both security researchers and malicious actors in exploiting these systems.
Among the vulnerabilities addressed, command injection issues are prevalent, primarily due to improper input validation. Critical flaws, such as CVE-2026-77537, have been patched in the UniFi Protect Application’s version 7.2.105, highlighting the severity of these security concerns.
Command Injection and Privilege Escalation
Many of the patched vulnerabilities involve command injection, which can be exploited by attackers to run arbitrary commands on affected devices. This includes the UniFi OS Server, Network Application, and others. Notably, CVE-2026-77537 in the UniFi Protect Application was rated a perfect 10.0, underscoring its critical nature.
Privilege escalation vulnerabilities were also addressed, allowing attackers to gain administrator-level access on various UniFi devices. These include Cloud Keys and Enterprise Fortress Gateways, with patches available in versions ranging from 5.1.31 to 5.1.37, depending on the device.
Authentication Bypass Concerns
Two significant authentication bypass vulnerabilities, CVE-2026-77549 and CVE-2026-77550, were also fixed. These flaws could allow network attackers to bypass login controls, posing significant risks if left unpatched. Both issues received maximum severity ratings and required immediate attention.
Ubiquiti has urged all users to update to the latest software versions, including UniFi Protect 7.2.105, UniFi OS Server 5.1.37, and others, to mitigate these risks.
Importance of Timely Updates
Given the history of exploitation of UniFi OS vulnerabilities, Ubiquiti’s recent patches are crucial in maintaining network security. Organizations are advised to apply these updates promptly and consider additional security measures such as isolating management interfaces from external networks and enforcing multi-factor authentication.
Security teams should prioritize these updates to prevent potential exploitation, especially for internet-facing devices. By staying proactive, organizations can better safeguard their networks against potential threats.
