CVE-2026-77557 Overview
CVE-2026-77557 is an Improper Access Control vulnerability [CWE-284] affecting Ubiquiti's UniFi Protect AI Key device. An attacker with network access to the device can escalate privileges without authentication or user interaction. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network-reachable exploitation with impact to confidentiality, integrity, and availability. Ubiquiti disclosed the issue in Security Advisory Bulletin 067.
Critical Impact
A network-adjacent attacker can escalate privileges on the UniFi Protect AI Key, potentially gaining administrative control of the surveillance appliance and its connected video data.
Affected Products
- Ubiquiti UniFi Protect AI Key
- Refer to UI Security Advisory Bulletin 067 for firmware versions
- No additional affected products listed in NVD
Discovery Timeline
- 2026-08-26 - CVE-2026-77557 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77557
Vulnerability Analysis
CVE-2026-77557 is classified as Improper Access Control [CWE-284] in the UniFi Protect AI Key. The AI Key is a dedicated appliance that offloads AI-driven video analytics from UniFi Protect deployments. According to Ubiquiti's advisory, an actor with access to the same network as the device can leverage the weakness to escalate privileges on the appliance itself.
Successful exploitation grants elevated access on a device that manages surveillance workloads and integrates with the broader UniFi Protect ecosystem. This creates downstream exposure for camera streams, recorded footage, and connected Protect controllers.
Root Cause
The root cause is missing or inadequate access control enforcement on privileged functionality exposed by the AI Key. When authorization checks are absent or incomplete, requests from unauthenticated or low-privilege network callers can reach operations reserved for administrators. Ubiquiti has not published implementation-level details, and no proof-of-concept code is publicly available.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker positioned on the local network segment where the UniFi Protect AI Key is reachable can send crafted requests to the device's management interface. See the UI Security Advisory Bulletin 067 for vendor-provided technical guidance.
No verified public exploit or proof-of-concept code is available. A prose description is provided in place of synthetic code.
Detection Methods for CVE-2026-77557
Indicators of Compromise
- Unexpected administrative sessions or configuration changes on the UniFi Protect AI Key
- New or modified user accounts on the device without a corresponding change ticket
- Outbound connections from the AI Key to unfamiliar external hosts
- Unusual access to recorded video, camera streams, or Protect API endpoints from internal hosts
Detection Strategies
- Compare current AI Key configuration and account inventory against a known-good baseline
- Alert on management-plane HTTP or API requests originating from hosts that are not authorized administrators
- Correlate authentication and privilege-change events on UniFi Protect controllers with activity from the AI Key
Monitoring Recommendations
- Forward UniFi Protect and AI Key logs to a centralized SIEM or data lake for retention and correlation
- Monitor the management VLAN for unauthorized devices and lateral movement toward Protect infrastructure
- Track firmware versions across all UniFi Protect AI Key devices and flag any running vulnerable builds
How to Mitigate CVE-2026-77557
Immediate Actions Required
- Apply the firmware update referenced in UI Security Advisory Bulletin 067 to every UniFi Protect AI Key
- Restrict network reachability of the AI Key management interface to trusted administrator subnets only
- Rotate administrator credentials and API tokens associated with UniFi Protect after patching
- Review recent AI Key logs and configuration for signs of unauthorized privilege changes
Patch Information
Ubiquiti has released fixed firmware for the UniFi Protect AI Key. Refer to UI Security Advisory Bulletin 067 for the specific fixed versions and update procedure. Apply the update through the UniFi update workflow and verify the running firmware after reboot.
Workarounds
- Isolate the UniFi Protect AI Key on a dedicated management VLAN with strict ACLs
- Block inbound access to the AI Key from user, guest, and IoT network segments
- Disable remote management access until firmware updates have been applied and verified
# Example firewall rule concept: restrict AI Key management access to admin subnet only
# Replace interface names, IPs, and ports with values that match your environment
# Permit only the administrator subnet
allow from 10.10.10.0/24 to <AI_KEY_IP> port 443
# Deny all other sources
deny from any to <AI_KEY_IP> port 443
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
