CVE-2026-77533: UniFi Protect Application RCE Vulnerability

CVE-2026-77533 Overview

CVE-2026-77533 is a command injection vulnerability in the Ubiquiti UniFi Protect Application. The flaw stems from improper input validation ([CWE-20]) in a network-reachable component. An attacker with network access and low-privilege credentials can inject operating system commands that execute on the host device. Successful exploitation results in full compromise of the underlying host running the UniFi Protect Application, including confidentiality, integrity, and availability impact. The scope change indicated by the CVSS vector means impact extends beyond the vulnerable component to the host environment.

Critical Impact
An authenticated low-privilege attacker on the network can execute arbitrary commands on the host running UniFi Protect, leading to full device compromise.

Affected Products

Ubiquiti UniFi Protect Application (see vendor advisory for fixed versions)
UniFi network video recording appliances running the vulnerable Protect Application
Refer to UI Security Advisory Bulletin 067 for the authoritative list of affected builds

Discovery Timeline

2026-08-26 - CVE-2026-77533 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77533

Vulnerability Analysis

CVE-2026-77533 is a command injection weakness in the UniFi Protect Application. The application accepts input from an authenticated, low-privilege network user and passes it into an operating system command context without adequate validation or sanitization. Because the input reaches a shell or command interpreter, an attacker can append or embed shell metacharacters to run arbitrary commands. The CVSS vector reports a changed scope, meaning code executed by the vulnerable process affects resources outside its original security boundary, typically the host device itself. This class of flaw ([CWE-20]) commonly enables full device takeover, persistence, and lateral movement within camera and NVR networks. The Exploit Prediction Scoring System (EPSS) data indicates measurable near-term exploitation likelihood, and no public proof-of-concept has been listed at publication time.

Root Cause

The root cause is improper input validation of user-supplied data before it is concatenated into a system command. The application trusts request parameters that should be treated as untrusted and does not enforce allow-lists, encoding, or safe API alternatives such as parameterized process invocation.

Attack Vector

An attacker requires network reachability to the UniFi Protect Application and a low-privilege account. The attacker submits a crafted request containing shell metacharacters in a parameter that the application forwards to an OS command. Because no user interaction is required and attack complexity is low, exploitation can be automated once a valid credential is obtained. See UI Security Advisory Bulletin 067 for vendor-supplied technical detail.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the vendor advisory for reproduction details.

Detection Methods for CVE-2026-77533

Indicators of Compromise

Unexpected child processes spawned by the UniFi Protect Application service, particularly shells such as sh, bash, or busybox
Outbound network connections from the Protect host to unfamiliar IP addresses shortly after authenticated API requests
New or modified files under Protect application directories, cron entries, or /tmp payloads
Anomalous authentication events for low-privilege UniFi Protect accounts followed by administrative API calls

Detection Strategies

Inspect Protect application and reverse-proxy logs for request parameters containing shell metacharacters such as ;, |, `, $(, or newline sequences
Correlate authenticated API calls with process-creation telemetry on the Protect host to identify command execution deviating from baseline
Alert on the Protect service process invoking system utilities such as wget, curl, nc, or python that are not part of normal operation

Monitoring Recommendations

Enable and forward host process and command-line logging from UniFi Protect appliances to a centralized SIEM or data lake
Baseline normal Protect service behavior and alert on deviations in process ancestry and outbound connections
Monitor administrative and low-privilege UniFi Protect accounts for unusual API usage patterns and failed authentication bursts

How to Mitigate CVE-2026-77533

Immediate Actions Required

Apply the fixed UniFi Protect Application build listed in UI Security Advisory Bulletin 067 without delay
Restrict network access to the UniFi Protect management interface to trusted administrative networks only
Rotate credentials for all UniFi Protect accounts, prioritizing any accounts with API or remote access
Review Protect hosts for signs of prior exploitation, including unexpected processes, files, and outbound connections

Patch Information

Ubiquiti has published fixed versions of the UniFi Protect Application. Consult UI Security Advisory Bulletin 067 for the exact fixed release numbers and upgrade guidance. Apply the update through the UniFi update mechanism or by installing the vendor-supplied package.

Workarounds

Isolate UniFi Protect appliances on a dedicated management VLAN with strict inbound access control lists
Disable or remove low-privilege accounts that are not strictly required until the patch is applied
Place the Protect management interface behind a VPN or zero-trust access proxy to remove direct network reachability

bash

# Example: restrict inbound access to the UniFi Protect management interface
# Replace 10.10.10.0/24 with your administrative network
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP