Ubiquiti Patches Three CVSS 10 Flaws in UniFi Products

Ubiquiti released patches Wednesday for three maximum-severity vulnerabilities across its UniFi product line. All three are CVSS 10.0, all three are remotely exploitable without authentication or user interaction, and all three affect different products in the stack — meaning you can’t patch one and call it done.

No active exploitation has been reported, but Ubiquiti confirmed the disclosure and urged immediate updates. Source: BleepingComputer.

The three flaws

CVE-2026-77537 — UniFi Protect Application
An improper input validation flaw in the UniFi Protect surveillance platform. Unauthenticated remote code execution, low-complexity attack, no user interaction.
Fix: UniFi Protect 7.2.105 or later.

CVE-2026-77550 — UniFi OS
A CRLF injection vulnerability in UniFi OS itself — the underlying OS running across UniFi network hardware. Allows authentication bypass by unauthenticated remote attackers. This affects devices at the OS layer, not just an application on top of it.
Fix: Apply latest UniFi OS build via your console. Ubiquiti’s advisory has the specific version; check community.ui.com for the security bulletin.

CVE-2026-77554 — UniFi Talk
Command injection through improper input validation in the UniFi Talk VoIP application. Unauthenticated remote code execution, no user interaction needed.
Fix: UniFi Talk 5.3.2 or later.

Why three separate updates matter

Each CVE is in a different product. If you run all three — Protect for cameras, UniFi OS hardware, and Talk for VoIP — you need three separate update actions. The OS-layer bug (CVE-2026-77550) is the most broadly applicable: it lives in the platform everything else runs on.

The 18 additional critical-severity vulnerabilities Ubiquiti patched in the same release window didn’t get their own CVE disclosures in initial reporting, but they’re in the same update packages. Apply the updates regardless.

What to do

1. UniFi Protect installations: Update to 7.2.105+ via your UniFi OS console.
2. All UniFi OS devices (switches, gateways, APs): Apply the latest OS update — check community.ui.com for the exact build number for CVE-2026-77550.
3. UniFi Talk deployments: Update to 5.3.2+ immediately, especially if the VoIP application is reachable from outside the internal network.

Ubiquiti gear is common in mid-market enterprises and managed service provider environments. If you run it for clients, push these updates to the top of your change window. CVSS 10.0 with no authentication barrier and no user interaction is about as bad as the scale gets.

Related coverage: Ubiquiti Patches Max-Severity UniFi Connect Command Injection · Avada WordPress Theme Patches Critical Zero-Click RCE