Quick answers
- Is CVE-2026-77557 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77557 being exploited in the wild.
- How severe is CVE-2026-77557?
- Critical severity, with a CVSS score of 9.8, published 26 August 2026.
- Which products and versions are affected?
- Ubiquiti UniFi Protect AI Key.
- Is there a fix for CVE-2026-77557?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77557 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-77557?
- Check whether you run Ubiquiti UniFi Protect AI Key. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper access control issue in UniFi Protect AI Key that allows a network-accessible attacker to escalate privileges on the device without authentication. The root cause is inadequate authorization checks on privileged operations, allowing an unauthenticated or low-privileged attacker to perform administrative actions. This is a network-reachable vulnerability with no user interaction required. Successful exploitation grants full device control, enabling an attacker to compromise video surveillance, access logs, and potentially the entire physical security posture of the managed premises.
Affected products
- Ubiquiti UniFi Protect AI Key
Timeline
- 2026-08-26: disclosed