UniFi Shipped Three Perfect Tens at Once — Patch the OS Before Anything Else

The short version//

On August 26 Ubiquiti published Security Advisory Bulletin 067 — and it's a big one. Twenty-two vulnerabilities across the entire UniFi line, with fixes available for every affected product at disclosure. Three of them score a perfect CVSS 10.0, all unauthenticated:

• CVE-2026-77537 — OS command injection in the UniFi Protect Application (video surveillance). Fixed in 7.2.105.
• CVE-2026-77554 — command injection in the UniFi Talk Application (VoIP phones). Fixed in 5.3.2.
• CVE-2026-77550 — a CRLF-injection auth-bypass in the web layer of devices running UniFi OS. This is the headline, and we'll get to why in a second.

Twenty-one of the twenty-two score 9.0 or above. The one below that bar (CVE-2026-77538, an unauth privesc in the Connect app at 8.2) even gets a vendor note saying it can be chained with dependency flaws to escalate on the host. For a single bulletin, that's a lot of "critical."

Why the CRLF bypass is the real story//

A CRLF injection is one of those old-school bugs that looks boring until you see what it buys. In CVE-2026-77550, an unauthenticated attacker who can reach the UniFi OS management interface over the network injects CRLF sequences into a request and lands an authenticated session — no credentials, low attack complexity (AC:L), scope changed to the whole device.

Here's why that matters: the same bulletin is full of flaws that require an authenticated session — command injections on the host (CVE-2026-77539/77540 on UniFi OS Server, 9.1 each), low-privilege-to-full-control access-control failures (CVE-2026-77534/77536, 9.9 each). Read in isolation those are "someone already has a login" bugs. CVE-2026-77550 hands the attacker exactly that session. Censys's analysis calls out that the tidy bypass-then-command-injection chain belongs specifically to UniFi OS Server, where the end state is remote code execution on the host. (There's a sibling flaw, CVE-2026-77549, same class and outcome but higher attack complexity — CVSS 9.0 instead of 10.)

So: one boring-looking bug turns a pile of "requires auth" bugs into "anyone on the network." That's how you lose a rack.

The patch table (OS first)//

Every product has a fix, all available as of disclosure. Update UniFi OS before the applications — that closes the bypass that makes everything else chainable. The vendor bulletin lists fixed versions per product:

Product	Fixed in
UniFi OS Server	5.1.37 or later
Cloud Keys, NVRs / Enterprise NVRs, Dream Machines, EFC, Dream Routers, Fortress Gateway, Cloud Gateways, Dream Wall, Express 7	5.1.31 or later
UniFi NAS	5.1.32 or later
UniFi Express (v4)	4.0.17 or later
Protect Application	7.2.105 or later
Network Application	10.5.67 or later (bulletin lists ≤10.4.57 as affected)
Access Application	4.3.5 or later
Connect Application	3.24.22 or later
Talk Application	5.3.2 or later

A few of those fixes predate the bulletin by weeks (Network 10.5.67 shipped July 23, Connect 3.24.22 in June) — which is exactly the "patched but unpatched-by-you" flavor that makes these bulletins annoying to read about.

The numbers that should bother you//

• Censys counts ~102,607 internet-facing UniFi OS management interfaces (as of Aug 27) and ~52,000 more exposing the Network Application — and that population is not predominantly enterprise: it's self-hosted UniFi OS Server instances on cloud providers plus prosumer CPE on residential ISPs.
• ~828 exposed UniFi Protect hosts for CVE-2026-77537 (Censys, single-source number — treat as an order of magnitude).
• No public PoC exists yet for any Bulletin 067 CVE, and none of the 22 are in CISA's KEV catalog. The NVD scores currently displayed are Ubiquiti's own — NVD hasn't finished its analysis.

Repeat offender, again//

This is not UniFi OS's first max-severity month. In June, three flaws from SAB-064 — CVE-2026-34908, CVE-2026-34909, CVE-2026-34910 — landed on the KEV catalog after active exploitation, and CISA gave federal agencies three days to remediate. Bishop Fox later demonstrated those flaws chain into unauthenticated RCE with elevated privileges. If you've seen Bulletin 067 and 064 coverage get conflated (both are UniFi OS), that's why: different bulletins, same software layer, same shape of bug.

What you should do//

1. Update UniFi OS first — 5.1.37+ on an OS Server, 5.1.31+ on gateways/Dream Machines/Cloud Keys/NVRs, 5.1.32+ on the NAS, 4.0.17+ on Express v4. This kills the auth-bypass and breaks the chain.
2. Then update the applications — Protect to 7.2.105+, Network to 10.5.67+, Access to 4.3.5+, Connect to 3.24.22+, Talk to 5.3.2+. Don't treat these as a lower tier; several are directly exploitable unauthenticated without the bypass.
3. If your UniFi OS is internet-facing, that's the worst case — front it with a VPN or IP allowlist while you patch, and assume someone has had a look at it.
4. Verify the version string after the upgrade. UniFi updates are the kind of thing that can silently no-op on a stuck channel; check Settings → System in each app.
5. Read the vendor bulletin — it's unusually complete, with per-product affected ranges and fixed versions for all 22.