CVE-2026-77545: CWE-489 Active debug code in Ubiquiti Inc UniFi OS Server

This vulnerability, identified as CWE-489 (Active Debug Code), exists in certain versions of Ubiquiti Inc's UniFi OS Server. It allows a malicious actor with network access and low privileges to exploit active debug code to escalate privileges within the UniFi OS environment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) reflects that the attack can be performed remotely over the network with low complexity, requires low privileges and user interaction, and results in a complete compromise of confidentiality, integrity, and availability with scope change.

Successful exploitation could lead to full privilege escalation on the UniFi OS device or instance, compromising system confidentiality, integrity, and availability. This could allow an attacker to gain unauthorized control over the device and potentially disrupt network operations or access sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications closely for updates. No vendor advisory or patch links are currently available. No known exploits in the wild have been reported, so immediate exploitation risk appears low but vigilance is advised.