CVE-2026-77540: CWE-20 Improper input validation in Ubiquiti Inc UniFi OS Server

This vulnerability (CVE-2026-77540) in UniFi OS Server arises from improper input validation (CWE-20) that can be exploited by a malicious actor with network access and high privileges to execute arbitrary commands on the host system. The flaw enables command injection, potentially compromising the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on system security properties. The vulnerability is published and assigned by Ubiquiti but currently lacks a vendor-provided remediation or patch. The affected versions are not explicitly stated in the available data.

Successful exploitation allows an attacker with high privileges on the network to execute arbitrary commands on the UniFi OS Server host, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized control over the device and disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to trusted users with high privileges and monitor for suspicious activity related to command execution on the UniFi OS Server host.