Executive brief
UniFi OS is a network management platform used to centrally control and monitor Ubiquiti network devices. A network-adjacent attacker with low-level system access could bypass access controls to escalate their privileges, potentially gaining full administrative control over affected UniFi infrastructure and the networks it manages.
Technical details
This is an improper access control vulnerability affecting UniFi OS that allows privilege escalation. The vulnerability requires network access and pre-existing low privileges on the affected device, but does not require authentication bypass. An attacker with these preconditions can exploit the access control weakness to elevate to higher privilege levels, potentially achieving administrative access. The vulnerability has been assigned CVE-2026-77536 with a CVSS score of 9.9 (critical). Patch availability should be confirmed through Ubiquiti's security advisory.
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-08-26: disclosed