CVE-2026-77536: UniFi OS Privilege Escalation Vulnerability

CVE-2026-77536 Overview

CVE-2026-77536 is an Improper Access Control vulnerability [CWE-284] affecting certain devices running Ubiquiti UniFi OS. An authenticated attacker with network access and low privileges can escalate privileges within affected UniFi OS devices or instances. The scope-changed CVSS 3.1 vector indicates the attacker can impact resources beyond the initially vulnerable component, which explains the elevated base score. Ubiquiti disclosed the issue in Security Advisory Bulletin 067.

Critical Impact
A low-privileged network user can gain administrative control over UniFi OS devices, compromising confidentiality, integrity, and availability of the managed network infrastructure.

Affected Products

Ubiquiti UniFi OS (specific device models and versions listed in the vendor advisory)
UniFi OS instances managed through affected hardware consoles
See UI Community Security Advisory 067 for the authoritative product and version matrix

Discovery Timeline

2026-08-26 - CVE-2026-77536 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77536

Vulnerability Analysis

The vulnerability stems from Improper Access Control [CWE-284] within UniFi OS. Authorization checks fail to consistently validate whether the requesting principal holds the privilege required to perform sensitive operations. A user who has already authenticated with low-privilege credentials can invoke functionality that should be restricted to administrators.

The scope-changed impact indicates that a successful attacker escalates privileges beyond the vulnerable component. On a UniFi OS device, this typically means moving from an application-level user context into administrative control over the console itself, including any downstream managed network devices.

Root Cause

According to the vendor advisory, the root cause is a missing or incorrectly enforced access control decision on privileged actions exposed by UniFi OS. Ubiquiti has not published low-level technical details. Full technical context is documented in the UI Community Security Advisory 067.

Attack Vector

The attack requires network reachability to the UniFi OS management interface and valid low-privilege credentials. No user interaction is required. An attacker with these prerequisites issues requests to privileged endpoints and receives elevated authority because the authorization layer fails to reject the call. Exposed management interfaces on untrusted networks materially increase exploitability.

No public proof-of-concept exploit is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-77536

Indicators of Compromise

Unexpected creation, modification, or promotion of UniFi OS administrator accounts
Configuration changes to firewall rules, VPN settings, or port forwarding not tied to a change request
Authentication events from low-privileged accounts followed by privileged API calls within a short window
New SSH keys, remote access tokens, or Ubiquiti cloud associations added to the console

Detection Strategies

Enable and forward UniFi OS audit and application logs to a centralized log platform for correlation
Alert on privilege changes and administrative actions performed by accounts that do not normally hold those roles
Baseline API request patterns for each user role and flag deviations, especially non-admin accounts hitting admin endpoints
Monitor for management interface access originating from unexpected network segments or geolocations

Monitoring Recommendations

Ingest UniFi controller logs into a SIEM or data lake and retain sufficient history to reconstruct privilege changes
Track firmware versions across the UniFi fleet and alert on devices running versions before the fix published in Advisory 067
Review administrator account inventories weekly and reconcile against approved personnel

How to Mitigate CVE-2026-77536

Immediate Actions Required

Apply the UniFi OS firmware update referenced in UI Community Security Advisory 067 to all affected consoles
Audit every UniFi OS account and remove or reset credentials for accounts that are dormant, shared, or unnecessary
Rotate credentials and API tokens for any account that could have interacted with an unpatched console
Review administrator lists and recent configuration changes for signs of unauthorized modification

Patch Information

Ubiquiti has released fixed firmware for affected UniFi OS devices. Consult the UI Community Security Advisory 067 for exact fixed versions per product line. Apply updates through the UniFi OS update workflow or the Ubiquiti cloud management console.

Workarounds

Restrict management interface access to trusted management VLANs or a dedicated jump host until patches are applied
Disable remote access and Ubiquiti cloud login for the console where operationally feasible
Enforce multi-factor authentication on all UniFi OS accounts to raise the cost of credential-based access
Apply the principle of least privilege and remove low-privilege accounts that do not need console access

bash

# Example: restrict UniFi OS management access to a trusted subnet at the network edge
# Adjust interface and subnet values to match your environment
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 22  -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22  -j DROP