CVE-2026-77547
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.
Risk Assessment
Command injection could allow the attacker to execute arbitrary commands on the device, potentially leading to full system compromise.
Recommendation
It is recommended to update UniFi Access Application to the latest version and restrict user privileges.
Other vulnerabilities in UniFi Access Application
See all- CVE-2026-77553Critical
An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in UniFi Access Application to escalate privileges on the host device.
- CVE-2026-77546Critical
An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.
- CVE-2026-77543Critical
An attacker with network access and low privileges can exploit an improper input validation vulnerability in the UniFi Access Application to execute a command injection on the host device.
- CVE-2026-54400Critical
A vulnerability in UniFi Access Application allows privilege escalation on the host device. An attacker with network access and high privileges can exploit improper access control.
- CVE-2026-50748Critical
A vulnerability in the UniFi Access Application allows an attacker with network access and low privileges to execute command injection on the host device due to improper input validation.
- CVE-2026-55117High
A Path Traversal vulnerability in UniFi Access Application allows a malicious actor with network access to read files on the host device.
Original NVD description (English source)
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS