Reported by 3 outlets

Timeline

1. original reporting

   Ubiquiti patches three max severity security vulnerabilities

   bleepingcomputer.com · 48d ago · August 26th, 2026

   Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. The first (tracked as CVE-2026-77537 ) lets unauthenticated attackers compromise unpatched devices by exploiting an improper input validation weakness in the UniFi Protect Application video surveillance management platform. Ubiquiti also addressed a CRLF injection flaw ( CVE-2026-77550 ) that remote attackers without privileges can exploit to bypass authentication on UniFi OS devices or instances. "A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running CRLF Injection to bypass authentication to such UniFi OS devices or instances," it explained. The third maximum severity vulnerability patched today is a command injection security flaw ( CVE-2026-77554 ) stemming from improper input validation in the UniFi Talk Application Voice over IP (VoIP) phone system. The company addressed these flaws in UniFi Protect Application 7.2.105 or later, UniFi Talk Application 5.3.2 or later, and UniFi OS Server 5.1.21 and earlier. Ubiquiti has yet to disclose whether any of these security vulnerabilities were exploited in the wild before patching, but shared that they can be exploited in low-complexity attacks that don't require user interaction. On Thursday, Ubiquiti patched 18 more critical-severity security issues affecting a wide range of products, fro

2. update from malware.news

   Ubiquiti security advisory (AV26-850)

   malware.news · 48d ago · August 26th, 2026

   Serial Number: AV26-850 Date: August 26, 2026 As of August 26, 2026, Ubiquiti is affected by critical vulnerabilities in the following products: UniFi OS Server Prior to or equal to 5.1.21 UniFi Connect Application Prior to or equal to 3.24.20 UniFi Network Application Prior to or equal to 10.4.57 UID Enterprise Agent Prior to or equal to 1.61.8 UniFi Access Application Prior to or equal to 4.3.3 UniFi Protect Application Prior to or equal to 7.1.87 UniFi Connect Display Cast Pro Prior to or equal to 1.0.108 UniFi Enterprise Audio/Video Bridge Prior to or equal to 1.0.10 UniFi Talk Application Prior to or equal to 5.2.7 UniFi Protect AI Key Prior to or equal to 2.1.3 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Ubiquiti UniFi - Security Advisory Bulletin 067 Article Link: Ubiquiti security advisory (AV26-850) - Canadian Centre for Cyber Security

3. update from cyberscoop.com

   Three 10.0 security flaws fixed across Ubiquiti’s UniFi line

   cyberscoop.com · 48d ago · August 26th, 2026

   Ubiquiti has patched 21 critical vulnerabilities, three of which were rated the highest severity possible, the communications product company said Wednesday in a security bulletin. In all, the company patched 22 vulnerabilities, with the last one rated “high,” it said in the bulletin . Three of the vulnerabilities had a Common Vulnerability Scoring System rating of 10 out of 10. Each of them would allow a hacker to access privileges on the device or application. In all three, hackers could exploit an improper access control vulnerability, the same kind in seven of the total vulnerabilities Ubiquiti disclosed Wednesday. Other vulnerabilities would allow hackers to do things like bypass authentication or run arbitrary commands. Ubiquiti, which claimed revenues of $2.57 billion last year, released the bulletin without commentary, besides identifying the vulnerabilities and recommended mitigations. The company did not immediately respond to a request for comment about whether it had seen any of the exploits used in the wild before they were patched. It disclosed one more in both May and July of th