CVE Record
[ CRITICAL ]CVE-2026-77554
UniFi Talk command injection — unauthenticated remote code execution
A CVSS 10.0 command injection flaw in Ubiquiti's UniFi Talk VoIP application allows unauthenticated remote code execution via improper input validation. Fixed in UniFi Talk 5.3.2.
- Vendor
- Ubiquiti
- Product
- UniFi Talk Application (versions before 5.3.2)
- CVSS
- 10.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-77554 is a maximum-severity (CVSS 10.0) command injection vulnerability in Ubiquiti’s UniFi Talk, the platform’s VoIP application. Improper input validation allows unauthenticated remote attackers to execute arbitrary OS commands in low-complexity attacks with no user interaction required.
Affected: UniFi Talk Application before 5.3.2
Fixed: UniFi Talk Application 5.3.2 or later
No known active exploitation at time of disclosure.
If you run UniFi Talk (VoIP/PBX deployments), update to 5.3.2 immediately.
