CVE-2026-77547: CWE-20 Improper input validation in Ubiquiti Inc UniFi Access Application

This vulnerability (CVE-2026-77547) in the UniFi Access Application by Ubiquiti Inc is classified as CWE-20 (Improper Input Validation). It enables an attacker with network access and low privileges to inject commands on the host device, potentially leading to full compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not provided a remediation level or patch information. The product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation could allow an attacker to execute arbitrary commands on the host device running the UniFi Access Application. This can lead to full system compromise, including unauthorized access to sensitive data, system manipulation, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor Ubiquiti's advisories for updates. Until a patch is available, restricting network access to trusted users and minimizing exposure of the UniFi Access Application may reduce risk.