CVE-2026-77548: UniFi Protect Command Injection RCE Flaw

CVE-2026-77548 Overview

CVE-2026-77548 is a command injection vulnerability in the Ubiquiti UniFi Protect Application. The flaw stems from improper input validation [CWE-20] on the host device. An authenticated attacker with network access and low privileges can inject operating system commands that execute on the underlying host.

The vulnerability carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Confidentiality, integrity, and availability of the host device are all fully impacted.

Critical Impact
A low-privileged network attacker can execute arbitrary commands on the host device running UniFi Protect, leading to full compromise of the video surveillance infrastructure and potentially connected network segments.

Affected Products

Ubiquiti UniFi Protect Application
UniFi Protect-enabled NVR appliances (UniFi Protect Network Video Recorders)
UniFi OS Consoles running the Protect Application

Discovery Timeline

2026-08-26 - CVE-2026-77548 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77548

Vulnerability Analysis

The vulnerability is a Command Injection flaw rooted in Improper Input Validation [CWE-20] within the UniFi Protect Application. User-supplied input reaches an operating system command interpreter without adequate sanitization or validation.

An attacker authenticated with low privileges can craft input containing shell metacharacters or command separators. When the application processes this input, the injected commands execute in the context of the host operating system. The scope change indicated in the CVSS vector reflects that code execution crosses the trust boundary of the Protect Application into the underlying host.

The combination of network reachability, low privilege requirement, and no user interaction makes this vulnerability practical to exploit in any environment where the UniFi Protect management interface is accessible to authenticated users.

Root Cause

The root cause is missing or insufficient input validation on a code path that constructs and executes host-level commands. Input from an authenticated user is concatenated into a shell command or passed to a command execution function without escaping or allow-listing. Refer to the UI Community Security Advisory #067 for vendor-supplied technical detail.

Attack Vector

Exploitation requires network access to the UniFi Protect Application and valid low-privileged credentials. The attacker submits a request containing a malicious payload to an affected endpoint. The application invokes a host-level command with the attacker-controlled data embedded, causing the injected command to run with the privileges of the Protect service process on the host.

No verified public exploit code is available. See the UI Community Security Advisory #067 for authoritative technical detail.

Detection Methods for CVE-2026-77548

Indicators of Compromise

Unexpected child processes spawned by the UniFi Protect service on NVR appliances or UniFi OS Consoles.
Outbound network connections from the Protect host to unknown destinations, especially reverse shells or download endpoints.
New or modified files in Protect application directories, cron entries, or persistence locations on the host.
Anomalous authenticated API requests to the Protect Application containing shell metacharacters such as ;, |, `, or $().

Detection Strategies

Inspect Protect Application HTTP request logs for parameters containing shell metacharacters or command separators.
Monitor process execution telemetry on Protect hosts for command interpreters (sh, bash) invoked by the Protect service.
Correlate authentication events for low-privileged accounts with subsequent process or network anomalies on the host.

Monitoring Recommendations

Enable process, file, and network telemetry collection on UniFi Protect hosts where supported.
Forward Protect Application and host logs to a centralized SIEM for retention and correlation.
Alert on any command execution originating from the Protect service account outside of its baseline profile.

How to Mitigate CVE-2026-77548

Immediate Actions Required

Apply the vendor-supplied update referenced in the UI Community Security Advisory #067 as soon as possible.
Restrict network access to the UniFi Protect management interface to trusted administrative networks only.
Audit all UniFi Protect user accounts and remove or rotate credentials for accounts that are unused or shared.
Review host and application logs for signs of exploitation prior to patching.

Patch Information

Ubiquiti has published fixed versions in the UI Community Security Advisory #067. Administrators should upgrade the UniFi Protect Application to the version listed in the advisory. On UniFi OS Consoles and NVR appliances, apply the corresponding UniFi OS update that bundles the fixed Protect release.

Workarounds

Place the UniFi Protect management interface behind a VPN or jump host to eliminate direct network exposure.
Enforce multi-factor authentication for all UniFi accounts to reduce the value of low-privileged credentials.
Segment UniFi Protect hosts on a dedicated VLAN with strict egress filtering to limit post-exploitation movement.

bash

# Example: restrict inbound access to the UniFi Protect UI to an admin subnet
# (adjust interface and admin CIDR to your environment)
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP