← News
/DISPATCH · 2026-09-01

Ubiquiti patches 22 UniFi vulnerabilities: three CVSS 10.0 across Protect, OS, and Talk

Ubiquiti released Security Advisory Bulletin 067, patching three CVSS 10.0 flaws in UniFi Protect, UniFi OS, and UniFi Talk. Unauthenticated attackers can achieve command injection and auth bypass. Over 100,000 instances are exposed to the public internet.

A rare UniFi patch wave: on August 26 Ubiquiti published Security Advisory Bulletin 067, disclosing 22 vulnerabilities at once. Three are CVSS 10.0, in video surveillance (UniFi Protect), the device OS (UniFi OS), and VoIP (UniFi Talk). All three are remotely exploitable by unauthenticated attackers.

Incident overview

The three critical issues hit distinct attack surfaces:

All three are network-vector, low-complexity, no privileges, no user interaction. The same bulletin also includes 18 additional issues across UniFi OS Server, the Network application, Protect AI Key, and multiple router, gateway, and NAS devices.

Technical details

CVE-2026-77550 is notable: CRLF (carriage return / line feed) marks end-of-header in HTTP and similar protocols. If the server writes attacker-controlled input containing raw CRLF into auth state without neutralization, the attacker can inject extra content and rewrite the authentication decision — effectively rewriting the login gate. The three bugs live in three independent services, so isolating the Protect management port does not protect UniFi OS's auth surface. Patch each component separately.

Impact assessment

Threat intel shows more than 100,000 UniFi OS instances exposed on the public internet. History is a warning: a structurally similar three-vuln chain patched in May went from advisory to botnet exploitation in about 33 days. CISA in June required federal agencies to patch similar issues within three days. No in-the-wild exploitation confirmed for this round yet, but the patch window for exposed instances is expected to be equally short.

Remediation

Sources