CVE-2026-77543: CWE-20 Improper input validation in Ubiquiti Inc UniFi Access Application

This vulnerability (CVE-2026-77543) in the UniFi Access Application arises from improper input validation (CWE-20). A malicious actor with network access and low privileges can exploit this flaw to execute arbitrary commands on the host device, potentially leading to full system compromise. The CVSS 3.1 base score of 9.9 reflects the ease of exploitation (network vector, low complexity, no user interaction) and the critical impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet provided a remediation or patch. The affected versions are not explicitly stated.

Successful exploitation allows an attacker with low privileges on the network to execute arbitrary commands on the host device running the UniFi Access Application. This can lead to complete compromise of the device, including unauthorized access to sensitive data, system manipulation, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the UniFi Access Application hosts to trusted users only and monitor for suspicious activity. Avoid exposing the application to untrusted networks.