Ubiquiti has patched three maximum-severity security flaws — each carrying the highest possible CVSS score of 10.0 — affecting products that millions of homes and businesses rely on for networking, security cameras, and office phone systems. The vulnerabilities allow unauthenticated remote attackers to break in without any credentials.
The first flaw, CVE-2026-77537, sits in the UniFi Protect Application, the platform used to manage UniFi video surveillance systems. An attacker can exploit an improper input validation weakness to compromise unpatched devices without logging in. The second, CVE-2026-77550, is a CRLF injection bug in UniFi OS itself: an attacker on the same network can send a crafted request to bypass authentication entirely on any affected UniFi OS device or instance. The third, CVE-2026-77554, affects the UniFi Talk VoIP phone application and allows command injection through improper input validation — again reachable without credentials. Ubiquiti notes that over 100,000 UniFi OS instances are currently visible on the public internet, though not all of those may be vulnerable.
How to check if you’re affected
Affected versions include UniFi Protect Application older than 7.2.105, UniFi Talk Application versions prior to 5.3.2, and UniFi OS Server 5.1.21 and earlier. Open the UniFi OS console or Ubiquiti’s update portal and check your installed versions against those thresholds. All three patches are available now — update immediately, since similar max-severity UniFi OS flaws patched earlier this year were actively exploited within weeks of disclosure.