CVE-2026-77539

Deferred Deferred - Pending Action

Command Injection in UniFi OS Server

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: fe490ce8-0395-4072-90d8-2707e1bdf984

Description

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-77539

EUVD

EUVD-2026-66366

Affected Vendors & Products

Vendor	Product	Version / Range
ubiquiti	unifi_os_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is a Command Injection flaw in UniFi OS Server caused by Improper Input Validation. A malicious actor with network access and high privileges could exploit it to execute arbitrary commands on the host device.

Detection Guidance

This vulnerability requires network access and high privileges to exploit. Detection involves checking UniFi OS Server versions for known vulnerable builds and monitoring for unusual command execution patterns. No specific commands are provided in the context.

Impact Analysis

An attacker could gain control of the affected system, leading to unauthorized access, data theft, or further compromise of connected systems. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability could lead to unauthorized command execution on the host device, potentially compromising sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized access or data breaches.

Mitigation Strategies

Immediately update UniFi OS Server to the latest patched version to address the Improper Input Validation vulnerability. Restrict network access to high-privilege accounts and monitor for unusual command execution activities.

Hi! I’m here to help you understand CVE-2026-77539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70