CVE-2026-77537: CWE-20 Improper input validation in Ubiquiti Inc UniFi Protect Application

This vulnerability, identified as CWE-20 (Improper Input Validation), exists in the UniFi Protect Application by Ubiquiti Inc. An attacker with network access can exploit this flaw to inject and execute arbitrary commands on the host device, potentially gaining full control. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and affects confidentiality, integrity, and availability with a critical severity rating. No affected versions or patch information are currently specified, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker on the network to execute arbitrary commands on the host running the UniFi Protect Application. This can lead to full system compromise, including unauthorized access to sensitive data, disruption of services, and potential control over the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the UniFi Protect Application to trusted users and networks only to reduce exposure.