CVE-2026-77539: CWE-20 Improper input validation in Ubiquiti Inc UniFi OS Server

This vulnerability (CVE-2026-77539) affects UniFi OS Server by Ubiquiti Inc and is classified as CWE-20 (Improper Input Validation). It allows a malicious actor with network access and elevated privileges to execute arbitrary commands on the host system via command injection. The CVSS v3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is published and reserved as of August 2026, but no patch or remediation level has been disclosed by the vendor. The affected versions are not explicitly stated.

Successful exploitation could lead to full compromise of the affected UniFi OS Server host, including unauthorized command execution with high privileges. This can result in complete loss of confidentiality, integrity, and availability of the system. The vulnerability requires the attacker to have network access and high privileges, limiting the attack surface to trusted or compromised users within the network. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to trusted users with high privileges and monitor for unusual activity. Avoid exposing UniFi OS Server management interfaces to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.