CVE-2026-77536: A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi…

PriorityP267critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.42%

33.5th percentile

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
ubiquiti_inc	cloud_gateways	< 5.1.31	5.1.31
ubiquiti_inc	cloud_keys	< 5.1.31	5.1.31
ubiquiti_inc	dream_machines	< 5.1.31	5.1.31
ubiquiti_inc	dream_routers	< 5.1.31	5.1.31
ubiquiti_inc	dream_wall	< 5.1.31	5.1.31
ubiquiti_inc	enterprise_firewall_core	< 5.1.31	5.1.31
ubiquiti_inc	enterprise_fortress_gateway	< 5.1.31	5.1.31
ubiquiti_inc	enterprise_network_attached_storage	< 5.1.31	5.1.31
ubiquiti_inc	enterprise_network_video_recorders	< 5.1.31	5.1.31
ubiquiti_inc	express_7	< 5.1.31	5.1.31
ubiquiti_inc	network_attached_storage	< 5.1.32	5.1.32
ubiquiti_inc	network_video_recorders	< 5.1.31	5.1.31
ubiquiti_inc	unifi_os_server	< 5.1.37	5.1.37

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.