CVE-2026-77537: UniFi Protect Command Injection RCE Flaw

CVE-2026-77537 Overview

CVE-2026-77537 is a command injection vulnerability in the Ubiquiti UniFi Protect Application. The flaw stems from improper input validation [CWE-20], allowing a network-adjacent attacker to inject operating system commands that execute on the host device. No authentication or user interaction is required to exploit the issue.

The vulnerability carries a CVSS 3.1 base score of 10.0 with a scope change, indicating that successful exploitation impacts resources beyond the vulnerable component. Ubiquiti disclosed the issue in Security Advisory Bulletin 067.

Critical Impact
Unauthenticated attackers with network access to a UniFi Protect Application host can execute arbitrary commands, leading to full host compromise, pivoting into connected camera infrastructure, and disruption of video surveillance operations.

Affected Products

Ubiquiti UniFi Protect Application (see vendor advisory for affected version ranges)
UniFi Protect deployments on UniFi Cloud Key and Dream Machine hardware running vulnerable Protect Application builds
Self-hosted UniFi Protect Application instances exposed to untrusted network segments

Discovery Timeline

2026-08-26 - CVE-2026-77537 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database
2026-08-26 - Ubiquiti publishes UI Community Security Advisory Bulletin 067

Technical Details for CVE-2026-77537

Vulnerability Analysis

The vulnerability resides in the UniFi Protect Application, the software that manages Ubiquiti's line of surveillance cameras and video recording appliances. The application fails to properly validate or sanitize input received over the network before that input reaches an operating system command execution path.

Because the CVSS vector reflects a scope change, the injected command runs in a context that can affect components outside the immediate application sandbox. Successful exploitation yields full compromise of the host device, exposure of stored surveillance footage, and a foothold on the internal network. UniFi Protect appliances often reside on trusted management VLANs, which amplifies the downstream blast radius.

Root Cause

The root cause is improper input validation [CWE-20] in a network-accessible handler of the UniFi Protect Application. User-controlled input is concatenated into a command that is later evaluated by a system shell or a child_process-style API without adequate escaping or allowlisting. Ubiquiti has not published field-level technical details beyond the advisory.

Attack Vector

Exploitation is remote, unauthenticated, and low complexity. An attacker who can reach the UniFi Protect Application over the network sends a crafted request containing shell metacharacters or command separators inside a parameter that the application forwards to an OS command. The injected payload executes with the privileges of the Protect Application process on the host.

No verified public proof-of-concept exploit is available at the time of publication. Refer to the UI Community Security Advisory Bulletin 067 for vendor-supplied technical context.

Detection Methods for CVE-2026-77537

Indicators of Compromise

Unexpected child processes spawned by the UniFi Protect Application service, particularly shells such as sh, bash, nc, curl, or wget.
Outbound network connections initiated from the Protect host to unfamiliar IP addresses or non-Ubiquiti update domains.
New or modified files in Protect Application working directories, cron entries, or systemd unit files not tied to legitimate upgrades.
Anomalous HTTP or API requests to Protect endpoints containing shell metacharacters such as ;, |, `, $(), or newline-encoded payloads.

Detection Strategies

Monitor process lineage on Protect appliances and self-hosted deployments for command interpreters descending from the Protect Application process.
Inspect Protect Application access and error logs for malformed parameters and requests originating from non-administrative subnets.
Deploy network detection rules that flag command-injection metacharacters in HTTP requests targeting the Protect API and web interface.

Monitoring Recommendations

Forward Protect host telemetry, including process, file, and network events, to a centralized analytics platform for behavioral analysis.
Baseline normal management traffic to UniFi Protect and alert on deviations such as new source hosts, unusual user agents, or spikes in POST request volume.
Alert on any interactive shell activity or outbound connections from surveillance VLANs that historically only communicate with cameras and the Protect controller.

How to Mitigate CVE-2026-77537

Immediate Actions Required

Upgrade the UniFi Protect Application to the fixed version identified in UI Community Security Advisory Bulletin 067.
Restrict network reachability of the Protect Application management interface to trusted administrative subnets using firewall or VLAN access controls.
Audit Protect hosts for signs of prior exploitation, including unexpected processes, outbound connections, and modified persistence mechanisms.
Rotate credentials, API tokens, and SSH keys associated with any Protect host that cannot be conclusively cleared.

Patch Information

Ubiquiti addresses CVE-2026-77537 in the UniFi Protect Application update referenced in Security Advisory Bulletin 067. Apply the vendor-supplied update through the UniFi update mechanism or by installing the fixed application package on self-managed hosts. Confirm the running version after upgrade to ensure the patched build is active.

Workarounds

Place UniFi Protect Application hosts behind a management firewall that permits access only from a jump host or VPN, eliminating direct exposure to general user networks.
Disable remote or cloud access features for Protect deployments until the patch is verified in production.
Segment surveillance infrastructure onto a dedicated VLAN with egress filtering that blocks arbitrary outbound internet traffic from Protect hosts.

bash

# Example iptables rules to restrict management access to a Protect host
# Replace 10.10.0.0/24 with your administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 7443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7443 -j DROP