# CVE-2026-77533: Ubiquiti UniFi Protect command injection via improper input validation

Source: https://junglewise.ai/threats/cve-2026-77533-ubiquiti-unifi-protect-command-injection-via-improper-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77533 · Severity: critical · CVSS 9.9 · Published 2026-08-26

UniFi Protect is a surveillance and access control management application used by organizations to monitor and secure physical premises. An attacker with network access and low privileges could inject malicious commands through improperly validated input, gaining the ability to execute arbitrary code on the host device and potentially compromise the entire security infrastructure.

Technologies: [Ubiquiti UniFi Protect](https://junglewise.ai/threats/technologies/unifi-protect). Vendors: [Ubiquiti](https://junglewise.ai/threats/vendors/ubiquiti).

## Quick answers

**Is CVE-2026-77533 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77533 being exploited in the wild.

**How severe is CVE-2026-77533?** Critical severity, with a CVSS score of 9.9, published 26 August 2026.

**Which products and versions are affected?** Ubiquiti UniFi Protect.

**Is there a fix for CVE-2026-77533?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77533 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2026-77533?** Check whether you run Ubiquiti UniFi Protect. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in UniFi Protect Application due to improper input validation. An attacker with network access and low-level privileges can craft malicious input that bypasses validation controls and is passed unsanitized to command execution functions on the host device. This allows remote code execution (RCE) with the privileges of the application, potentially leading to full system compromise. The vulnerability is classified as critical with a CVSS score of 9.9, indicating severe impact across confidentiality, integrity, and availability. Patch availability is expected through Ubiquiti's standard security update channels.

## Affected products

- Ubiquiti UniFi Protect

## Timeline

- 2026-08-26: disclosed

## References

- [https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9](https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9)

## Related threats

- [Ubiquiti UniFi Protect command injection via input validation](https://junglewise.ai/threats/cve-2026-77548-ubiquiti-unifi-protect-command-injection-via-input-validation)
- [Ubiquiti UniFi Protect command injection via improper input validation](https://junglewise.ai/threats/cve-2026-77537-ubiquiti-unifi-protect-command-injection-via-improper-input)
- [Ubiquiti UniFi Protect SQL injection privilege escalation](https://junglewise.ai/threats/cve-2026-56841-ubiquiti-unifi-protect-sql-injection-privilege-escalation)
- [Ubiquiti UniFi Protect auth bypass in data streaming](https://junglewise.ai/threats/cve-2026-54408-ubiquiti-unifi-protect-auth-bypass-in-data-streaming)