CVE-2026-77557: CWE-284 Improper Access Control - Generic in Ubiquiti Inc UniFi Protect AI Key

This vulnerability (CVE-2026-77557) involves improper access control in the UniFi Protect AI Key product by Ubiquiti Inc. An attacker with network access can exploit this flaw to escalate privileges on the device, potentially gaining unauthorized control. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges or user interaction required, and results in high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker on the network to escalate privileges on the UniFi Protect AI Key device, potentially leading to full compromise of the device's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the UniFi Protect AI Key device to trusted users only and monitor for suspicious activity.