UniFi Protect Application improper input validation — unauthenticated RCE
A CVSS 10.0 improper input validation flaw in Ubiquiti's UniFi Protect Application lets unauthenticated remote attackers execute arbitrary code with no user interaction. Fixed in UniFi Protect 7.2.105.
- Vendor
- Ubiquiti
- Product
- UniFi Protect Application (versions before 7.2.105)
- CVSS
- 10.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-77537 is a maximum-severity (CVSS 10.0) improper input validation vulnerability in Ubiquiti’s UniFi Protect Application, the software platform managing Ubiquiti’s IP camera and NVR ecosystem. An unauthenticated remote attacker can exploit the flaw in low-complexity attacks requiring no user interaction.
Affected: UniFi Protect Application before 7.2.105
Fixed: UniFi Protect Application 7.2.105 or later
No known active exploitation at time of disclosure.
Apply the update immediately via the UniFi OS console or by updating through the Ubiquiti application management interface.
