CVE-2026-77556: UniFi Gateway Out-of-Bounds Read DoS Flaw

CVE-2026-77556 Overview

CVE-2026-77556 is an out-of-bounds read vulnerability affecting certain Ubiquiti UniFi gateway devices. A network-adjacent attacker can trigger the flaw to cause a denial of service (DoS) condition on the gateway. The vulnerability is classified under [CWE-125] (Out-of-bounds Read) and does not require authentication or user interaction. Ubiquiti disclosed the issue in UI Community Security Advisory 069.

Critical Impact
Unauthenticated attackers on the network can crash UniFi gateway devices, disrupting routing, firewalling, and network connectivity for all downstream users.

Affected Products

Ubiquiti UniFi gateway devices (specific models identified in vendor advisory)
See UI Community Security Advisory 069 for the affected firmware versions

Discovery Timeline

2026-09-22 - CVE-2026-77556 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77556

Vulnerability Analysis

CVE-2026-77556 stems from an out-of-bounds read condition in the packet or protocol handling logic of affected UniFi gateway devices. When the gateway parses a crafted network input, it reads memory outside the intended buffer boundary. This read triggers a fault in the handling process, causing the service or device to crash.

UniFi gateways sit at the network perimeter and provide routing, firewalling, and VPN services. A crash on the gateway disrupts traffic for every connected client. Repeated exploitation sustains the outage indefinitely.

The vulnerability affects availability only. Ubiquiti's advisory does not describe any information disclosure resulting from the out-of-bounds read, and no confidentiality or integrity impact is recorded.

Root Cause

The defect is a missing or insufficient bounds check on attacker-supplied data during network packet processing. The affected code path dereferences an index or pointer that extends past the allocated buffer. The vendor advisory has not published detailed code-level analysis of the impacted parser.

Attack Vector

An attacker with network access to the device can send a specially crafted packet or sequence of packets to the gateway. No credentials, prior compromise, or user interaction are required. The attack complexity is low, and exploitation can be repeated to maintain the denial of service.

The vulnerability manifests during input parsing in the gateway's network stack. Refer to UI Community Security Advisory 069 for vendor-provided technical detail.

Detection Methods for CVE-2026-77556

Indicators of Compromise

Unexpected reboots, service restarts, or watchdog-triggered recoveries on UniFi gateway devices
Loss of routing or firewall function accompanied by kernel panic or crash entries in gateway system logs
Bursts of malformed or anomalous packets directed at the gateway's management or WAN interfaces preceding a crash

Detection Strategies

Forward UniFi gateway syslog data to a central SIEM and alert on repeated crash, segfault, or process restart events
Correlate gateway availability drops with upstream network telemetry showing anomalous inbound traffic
Deploy network-based intrusion detection signatures for malformed protocol traffic aimed at gateway management services

Monitoring Recommendations

Baseline normal uptime and process restart frequency for each UniFi gateway and alert on deviation
Monitor ICMP and SNMP reachability of the gateway from an out-of-band probe
Track inbound packet rates and error counters on the WAN interface for spikes preceding outages

How to Mitigate CVE-2026-77556

Immediate Actions Required

Apply the firmware update referenced in UI Community Security Advisory 069 to all affected UniFi gateway devices
Restrict inbound access to gateway management interfaces to trusted administrative networks only
Verify firmware version post-update and confirm the fixed build is running on each device

Patch Information

Ubiquiti has released fixed firmware as documented in UI Community Security Advisory 069. Administrators should consult the advisory for the specific model-to-version mapping and update through the UniFi controller or device UI.

Workarounds

Block untrusted networks from reaching the gateway's exposed services using upstream ACLs where feasible
Segment management interfaces onto a dedicated VLAN reachable only from trusted administrator hosts
Enable automatic firmware updates in the UniFi controller so future advisories are applied without delay

bash

# Configuration example
# Restrict inbound WAN access to gateway management via upstream ACL
# (adapt to your upstream router or ISP-provided CPE syntax)
ip access-list extended UNIFI-MGMT-PROTECT
  deny   tcp any host <gateway-wan-ip> eq 22
  deny   tcp any host <gateway-wan-ip> eq 443
  permit ip any any