Search
Find a vulnerability
Search criteria
220 vulnerabilities by Ubiquiti Inc
CVE-2026-95862 (GCVE-0-2026-95862)
Vulnerability from nvd – Published: 2026-09-22 18:49 – Updated: 2026-09-22 19:35
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:34 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:34:47.330586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:35:00.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:49:39.376Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-95862",
"datePublished": "2026-09-22T18:49:39.376Z",
"dateReserved": "2026-09-22T16:47:10.352Z",
"dateUpdated": "2026-09-22T19:35:00.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95861 (GCVE-0-2026-95861)
Vulnerability from nvd – Published: 2026-09-22 18:47 – Updated: 2026-09-22 19:34
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:34 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:34:07.360109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:34:16.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:47:13.695Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-95861",
"datePublished": "2026-09-22T18:47:13.695Z",
"dateReserved": "2026-09-22T16:47:06.490Z",
"dateUpdated": "2026-09-22T19:34:16.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77558 (GCVE-0-2026-77558)
Vulnerability from nvd – Published: 2026-09-22 18:43 – Updated: 2026-09-22 19:33
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:33 UTC
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:33:45.709368Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:33:53.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:43:14.612Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77558",
"datePublished": "2026-09-22T18:43:14.612Z",
"dateReserved": "2026-08-20T20:32:48.221Z",
"dateUpdated": "2026-09-22T19:33:53.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77556 (GCVE-0-2026-77556)
Vulnerability from nvd – Published: 2026-09-22 18:41 – Updated: 2026-09-22 19:33
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:33 UTC
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:33:13.667722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:33:21.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:41:15.201Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77556",
"datePublished": "2026-09-22T18:41:15.201Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-09-22T19:33:21.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77555 (GCVE-0-2026-77555)
Vulnerability from nvd – Published: 2026-09-22 18:38 – Updated: 2026-09-22 19:32
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:32 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:32:45.935116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:32:56.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:38:20.615Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77555",
"datePublished": "2026-09-22T18:38:20.615Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-09-22T19:32:56.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77544 (GCVE-0-2026-77544)
Vulnerability from nvd – Published: 2026-09-22 18:34 – Updated: 2026-09-22 19:32
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:32 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:32:07.314862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:32:21.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:34:39.993Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77544",
"datePublished": "2026-09-22T18:34:39.993Z",
"dateReserved": "2026-08-20T20:32:37.793Z",
"dateUpdated": "2026-09-22T19:32:21.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77557 (GCVE-0-2026-77557)
Vulnerability from nvd – Published: 2026-08-26 10:53 – Updated: 2026-08-26 12:38
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:38 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Protect AI Key |
Affected:
0 , < 2.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:38:11.472289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:38:19.953Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Protect AI Key",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:53:27.169Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77557",
"datePublished": "2026-08-26T10:53:27.169Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:38:19.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77554 (GCVE-0-2026-77554)
Vulnerability from nvd – Published: 2026-08-26 10:45 – Updated: 2026-08-26 12:42
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:39 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Talk Application |
Affected:
0 , < 5.3.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:39:49.246888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:42:21.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Talk Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:45:46.316Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77554",
"datePublished": "2026-08-26T10:45:46.316Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:42:21.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77553 (GCVE-0-2026-77553)
Vulnerability from nvd – Published: 2026-08-26 10:42 – Updated: 2026-08-26 12:45
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:45 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Application |
Affected:
0 , < 4.3.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:45:25.351665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:45:32.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device."
}
],
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:42:54.552Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77553",
"datePublished": "2026-08-26T10:42:54.552Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:45:32.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77552 (GCVE-0-2026-77552)
Vulnerability from nvd – Published: 2026-08-26 10:40 – Updated: 2026-08-26 12:46
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:45 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Enterprise Audio/Video Bridge |
Affected:
0 , < 1.0.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:45:48.275670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:46:01.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Enterprise Audio/Video Bridge",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:40:05.262Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77552",
"datePublished": "2026-08-26T10:40:05.262Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T12:46:01.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77551 (GCVE-0-2026-77551)
Vulnerability from nvd – Published: 2026-08-26 10:37 – Updated: 2026-08-26 12:49
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:49 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Display Cast Pro |
Affected:
0 , < 1.0.111
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:49:40.158407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:49:50.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.111",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device."
}
],
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:37:19.573Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77551",
"datePublished": "2026-08-26T10:37:19.573Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T12:49:50.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77550 (GCVE-0-2026-77550)
Vulnerability from nvd – Published: 2026-08-26 10:33 – Updated: 2026-08-27 03:56
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-93 - Improper neutralization of CRLF sequences ('CRLF injection')
Assigner
References
1 reference
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi OS Server |
Affected:
0 , < 5.1.37
(semver)
|
|
| Ubiquiti Inc | Cloud Keys |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Attached Storage |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewall Core |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Fortress Gateway |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Attached Storage |
Affected:
0 , < 5.1.32
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:56:41.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi OS Server",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.37",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Keys",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewall Core",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Fortress Gateway",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper neutralization of CRLF sequences (\u0027CRLF injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:33:29.989Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77550",
"datePublished": "2026-08-26T10:33:29.989Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-27T03:56:41.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77549 (GCVE-0-2026-77549)
Vulnerability from nvd – Published: 2026-08-26 10:30 – Updated: 2026-08-27 03:56
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-93 - Improper neutralization of CRLF sequences ('CRLF injection')
Assigner
References
1 reference
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi OS Server |
Affected:
0 , < 5.1.37
(semver)
|
|
| Ubiquiti Inc | Cloud Keys |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Attached Storage |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewall Core |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Fortress Gateway |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Attached Storage |
Affected:
0 , < 5.1.32
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77549",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:56:37.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi OS Server",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.37",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Keys",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewall Core",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Fortress Gateway",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper neutralization of CRLF sequences (\u0027CRLF injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:30:06.712Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77549",
"datePublished": "2026-08-26T10:30:06.712Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-27T03:56:37.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77548 (GCVE-0-2026-77548)
Vulnerability from nvd – Published: 2026-08-26 10:23 – Updated: 2026-08-26 12:51
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:51 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Protect Application |
Affected:
0 , < 7.2.105
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:51:31.530579Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:51:38.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Protect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "7.2.105",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device."
}
],
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:23:37.645Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77548",
"datePublished": "2026-08-26T10:23:37.645Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T12:51:38.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77547 (GCVE-0-2026-77547)
Vulnerability from nvd – Published: 2026-08-26 10:20 – Updated: 2026-08-26 13:18
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 13:18 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Application |
Affected:
0 , < 4.3.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:18:30.656771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:18:44.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device."
}
],
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:20:14.378Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77547",
"datePublished": "2026-08-26T10:20:14.378Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T13:18:44.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77546 (GCVE-0-2026-77546)
Vulnerability from nvd – Published: 2026-08-26 10:16 – Updated: 2026-08-26 13:19
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 13:19 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Application |
Affected:
0 , < 4.3.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:19:29.320986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:19:37.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device."
}
],
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:16:47.849Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77546",
"datePublished": "2026-08-26T10:16:47.849Z",
"dateReserved": "2026-08-20T20:32:37.793Z",
"dateUpdated": "2026-08-26T13:19:37.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77532 (GCVE-0-2026-77532)
Vulnerability from nvd – Published: 2026-08-26 11:01 – Updated: 2026-08-26 12:36
VLAI
EPSS
VEX
Summary
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:31 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | EdgeMAX EdgeSwitch |
Affected:
0 , < 1.12.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77532",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:31:49.192604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:36:20.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EdgeMAX EdgeSwitch",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.12.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device."
}
],
"value": "A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T11:01:30.309Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77532",
"datePublished": "2026-08-26T11:01:30.309Z",
"dateReserved": "2026-08-20T20:26:31.514Z",
"dateUpdated": "2026-08-26T12:36:20.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95862 (GCVE-0-2026-95862)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:49 – Updated: 2026-09-22 19:35
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:34 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:34:47.330586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:35:00.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:49:39.376Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-95862",
"datePublished": "2026-09-22T18:49:39.376Z",
"dateReserved": "2026-09-22T16:47:10.352Z",
"dateUpdated": "2026-09-22T19:35:00.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95861 (GCVE-0-2026-95861)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:47 – Updated: 2026-09-22 19:34
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:34 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:34:07.360109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:34:16.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:47:13.695Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-95861",
"datePublished": "2026-09-22T18:47:13.695Z",
"dateReserved": "2026-09-22T16:47:06.490Z",
"dateUpdated": "2026-09-22T19:34:16.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77558 (GCVE-0-2026-77558)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:43 – Updated: 2026-09-22 19:33
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:33 UTC
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:33:45.709368Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:33:53.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:43:14.612Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77558",
"datePublished": "2026-09-22T18:43:14.612Z",
"dateReserved": "2026-08-20T20:32:48.221Z",
"dateUpdated": "2026-09-22T19:33:53.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77556 (GCVE-0-2026-77556)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:41 – Updated: 2026-09-22 19:33
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:33 UTC
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:33:13.667722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:33:21.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:41:15.201Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77556",
"datePublished": "2026-09-22T18:41:15.201Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-09-22T19:33:21.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77555 (GCVE-0-2026-77555)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:38 – Updated: 2026-09-22 19:32
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:32 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:32:45.935116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:32:56.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:38:20.615Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77555",
"datePublished": "2026-09-22T18:38:20.615Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-09-22T19:32:56.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77544 (GCVE-0-2026-77544)
Vulnerability from cvelistv5 – Published: 2026-09-22 18:34 – Updated: 2026-09-22 19:32
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:32 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewalls |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.21
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | UniFi Gateways |
Affected:
0 , < 5.1.26
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:32:07.314862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:32:21.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewalls",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:34:39.993Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77544",
"datePublished": "2026-09-22T18:34:39.993Z",
"dateReserved": "2026-08-20T20:32:37.793Z",
"dateUpdated": "2026-09-22T19:32:21.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77532 (GCVE-0-2026-77532)
Vulnerability from cvelistv5 – Published: 2026-08-26 11:01 – Updated: 2026-08-26 12:36
VLAI
EPSS
VEX
Summary
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:31 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | EdgeMAX EdgeSwitch |
Affected:
0 , < 1.12.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77532",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:31:49.192604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:36:20.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EdgeMAX EdgeSwitch",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.12.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device."
}
],
"value": "A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T11:01:30.309Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77532",
"datePublished": "2026-08-26T11:01:30.309Z",
"dateReserved": "2026-08-20T20:26:31.514Z",
"dateUpdated": "2026-08-26T12:36:20.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77557 (GCVE-0-2026-77557)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:53 – Updated: 2026-08-26 12:38
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:38 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Protect AI Key |
Affected:
0 , < 2.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:38:11.472289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:38:19.953Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Protect AI Key",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:53:27.169Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77557",
"datePublished": "2026-08-26T10:53:27.169Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:38:19.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77554 (GCVE-0-2026-77554)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:45 – Updated: 2026-08-26 12:42
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:39 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Talk Application |
Affected:
0 , < 5.3.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:39:49.246888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:42:21.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Talk Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:45:46.316Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77554",
"datePublished": "2026-08-26T10:45:46.316Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:42:21.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77553 (GCVE-0-2026-77553)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:42 – Updated: 2026-08-26 12:45
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:45 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Application |
Affected:
0 , < 4.3.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:45:25.351665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:45:32.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device."
}
],
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:42:54.552Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77553",
"datePublished": "2026-08-26T10:42:54.552Z",
"dateReserved": "2026-08-20T20:32:43.655Z",
"dateUpdated": "2026-08-26T12:45:32.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77552 (GCVE-0-2026-77552)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:40 – Updated: 2026-08-26 12:46
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:45 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Enterprise Audio/Video Bridge |
Affected:
0 , < 1.0.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:45:48.275670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:46:01.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Enterprise Audio/Video Bridge",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:40:05.262Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77552",
"datePublished": "2026-08-26T10:40:05.262Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T12:46:01.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77551 (GCVE-0-2026-77551)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:37 – Updated: 2026-08-26 12:49
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:49 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Display Cast Pro |
Affected:
0 , < 1.0.111
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:49:40.158407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:49:50.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.111",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device."
}
],
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:37:19.573Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77551",
"datePublished": "2026-08-26T10:37:19.573Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-26T12:49:50.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77550 (GCVE-0-2026-77550)
Vulnerability from cvelistv5 – Published: 2026-08-26 10:33 – Updated: 2026-08-27 03:56
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-93 - Improper neutralization of CRLF sequences ('CRLF injection')
Assigner
References
1 reference
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi OS Server |
Affected:
0 , < 5.1.37
(semver)
|
|
| Ubiquiti Inc | Cloud Keys |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Video Recorders |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Network Attached Storage |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Machines |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Firewall Core |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Routers |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Enterprise Fortress Gateway |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Cloud Gateways |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Dream Wall |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Express 7 |
Affected:
0 , < 5.1.31
(semver)
|
|
| Ubiquiti Inc | Network Attached Storage |
Affected:
0 , < 5.1.32
(semver)
|
|
| Ubiquiti Inc | Express |
Affected:
0 , < 4.0.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:56:41.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi OS Server",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.37",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Keys",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Video Recorders",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Machines",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Firewall Core",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Routers",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Fortress Gateway",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cloud Gateways",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dream Wall",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express 7",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network Attached Storage",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "5.1.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Express",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "4.0.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"value": "A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper neutralization of CRLF sequences (\u0027CRLF injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T10:33:29.989Z",
"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"shortName": "Ubiquiti"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"assignerShortName": "Ubiquiti",
"cveId": "CVE-2026-77550",
"datePublished": "2026-08-26T10:33:29.989Z",
"dateReserved": "2026-08-20T20:32:37.794Z",
"dateUpdated": "2026-08-27T03:56:41.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}