CVE-2026-77554: CWE-20 Improper input validation in Ubiquiti Inc UniFi Talk Application

This vulnerability (CVE-2026-77554) affects the UniFi Talk Application by Ubiquiti Inc. It is caused by improper input validation (CWE-20), which can be exploited by a malicious actor with network access to execute arbitrary commands on the host device. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. The vulnerability is published but currently lacks an official remediation or patch from the vendor. There are no known exploits in the wild at this time.

An attacker with network access can exploit this vulnerability to execute arbitrary commands on the host device running the UniFi Talk Application. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the UniFi Talk Application and monitor for suspicious activity. Follow vendor updates closely for official patches or mitigations.