Ubiquiti Patches 22 Vulnerabilities, Including Three CVSS 10 UniFi Flaws
Summary
Ubiquiti patched 22 vulnerabilities, mostly affecting UniFi products. Three named flaws were rated CVSS 10 and could enable privilege access; the article also notes CISA had listed three Ubiquiti flaws as known exploited.
Key points
- Ubiquiti patched 22 vulnerabilities; all but one affect its UniFi product line.
- CVE-2026-77537, CVE-2026-77550 and CVE-2026-77554 were rated CVSS 10.
- The three critical flaws involve improper access control and could let attackers gain privileges on affected devices or applications.
- Other disclosed issues include authentication bypass and arbitrary command execution.
- Ubiquiti released a security bulletin with recommended mitigations but did not say whether the newly patched flaws had been exploited in the wild.
- CISA had added three Ubiquiti vulnerabilities to its list of flaws known to have been exploited; the article does not identify them as the three CVSS 10 flaws.
Article Details
- Vulnerability Types
- Improper access control
- Authentication bypass
- Arbitrary command execution
- Severity
- Three vulnerabilities rated CVSS 10 out of 10.
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available