CVE-2026-77533
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
An Improper Input Validation vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to execute a Command Injection on the host device.
Risk Assessment
An attacker could gain full control of the device, potentially compromising system integrity and data access.
Recommendation
Update UniFi Protect Application to the latest version. Restrict network access to the application and apply the principle of least privilege.
Other vulnerabilities in UniFi Protect Application
See all- CVE-2026-21633High
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).
- CVE-2026-77548Critical
An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Protect Application to execute a Command Injection on the host device.
- CVE-2026-77537Critical
An attacker with network access can exploit an improper input validation vulnerability in the UniFi Protect Application to execute a command injection on the host device.
- CVE-2026-55115Critical
An SSRF vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.
- CVE-2026-56841High
An authenticated SQL Injection vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.
- CVE-2026-54408High
A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.
- CVE-2026-54407High
An Improper Access Control vulnerability in UniFi Protect Application allows a network-accessible attacker to bypass authentication in certain API endpoints.
Original NVD description (English source)
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS