CVE-2026-77535: 
Ubiquiti UniFi vulnerability analysis and mitigation

CVE-2026-77535 is an Improper Input Validation vulnerability in Ubiquiti's UniFi Network Application that enables command injection on adopted network devices. A malicious actor with high privileges and network access can exploit this flaw to execute arbitrary commands on devices managed by the application. All versions of UniFi Network Application prior to 10.5.67 are affected. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical), assigned by Ubiquiti, and was published on August 26, 2026 (Ubiquiti Advisory, EUVD).

The root cause is classified as CWE-20 (Improper Input Validation), where user-supplied input is not adequately sanitized before being passed to system-level command execution routines within the UniFi Network Application. An attacker with high privileges (e.g., administrator-level access) can craft malicious input over the network that triggers command injection on an adopted UniFi device — a device managed and provisioned through the application. The attack vector is network-based, requires no user interaction, and the scope is changed, meaning the impact extends beyond the application itself to the underlying adopted devices (Ubiquiti Advisory, EUVD).

Successful exploitation grants an attacker complete control over adopted UniFi devices, with high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary commands on managed devices, potentially exfiltrating sensitive configuration data, modifying device behavior, disrupting network operations, or using compromised devices as pivot points for lateral movement within the network. The changed scope means the impact propagates beyond the UniFi Network Application itself to all devices under its management (Ubiquiti Advisory, GBHackers).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The CVE status is listed as "Deferred" and the NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable, as it requires high privileges to exploit. The EPSS score is approximately 0.0081 (0.81%), reflecting a low near-term exploitation probability. CVE-2026-77535 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (EUVD).

Ubiquiti has addressed this vulnerability in UniFi Network Application version 10.5.67 and later; administrators should upgrade immediately (Ubiquiti Advisory). As interim mitigations, restrict network access to the UniFi Network Application to trusted administrators only, implement network segmentation to limit exposure, and apply the principle of least privilege to administrative accounts. Monitor application logs for anomalous command execution patterns or unexpected configuration changes on adopted devices (GBHackers).

The vulnerability was disclosed as part of a broader Ubiquiti security advisory (Bulletin 067) addressing 22 UniFi flaws, including three rated at CVSS 10.0, which drew significant media attention (Ubiquiti Advisory). Security news outlets including CyberSecurityNews, GBHackers, and TechTimes covered the batch disclosure, highlighting the severity of the overall advisory and Ubiquiti's remediation effort (CyberSecurityNews, GBHackers, TechTimes). Community reaction focused on the breadth of the advisory rather than this specific CVE, with no notable individual researcher commentary identified for CVE-2026-77535.