UniFi Talk command injection — unauthenticated remote code execution
A CVSS 10.0 command injection flaw in Ubiquiti's UniFi Talk VoIP application allows unauthenticated remote code execution via improper input validation. Fixed in UniFi Talk 5.3.2.
- Vendor
- Ubiquiti
- Product
- UniFi Talk Application (versions before 5.3.2)
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.6%
- Status
- patched
- Published
Is CVE-2026-77554 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-77554 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.6% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-77554 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-77554 is a maximum-severity (CVSS 10.0) command injection vulnerability in Ubiquiti’s UniFi Talk, the platform’s VoIP application. Improper input validation allows unauthenticated remote attackers to execute arbitrary OS commands in low-complexity attacks with no user interaction required.
Affected: UniFi Talk Application before 5.3.2
Fixed: UniFi Talk Application 5.3.2 or later
No known active exploitation at time of disclosure.
If you run UniFi Talk (VoIP/PBX deployments), update to 5.3.2 immediately.
Other Ubiquiti CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-77550 UniFi OS CRLF injection — authentication bypasswrite-up | [ CRITICAL ] | 10.0 | 0.8% | — |
| CVE-2026-77537 UniFi Protect Application improper input validation — unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 1.6% | — |
| CVE-2026-54400 Ubiquiti UniFi Access improper access control (Bulletin 066)write-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-50748 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 1.6% | — |
| CVE-2026-50747 Ubiquiti UniFi critical flaw (Bulletin 066)write-up | [ CRITICAL ] | 9.9 | 0.5% | — |
| CVE-2026-50746 Ubiquiti UniFi Connect command injection (Bulletin 066)write-up | [ CRITICAL ] | 10.0 | 1.7% | — |
| CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability | [ CRITICAL ] | 10.0 | 45.8% | |
| CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability | [ CRITICAL ] | 10.0 | 1.8% |
