Vulnerability details
CVE-2026-77534
Ubiquiti Cloud GatewaysUbiquiti Cloud KeysUbiquiti Dream MachinesUbiquiti Dream RoutersUbiquiti Dream WallUbiquiti Enterprise Firewall Core
CVSS 3.1
9.9Critical
Official description
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (Ubiquiti) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Ubiquiti Inc | Cloud Gateways | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Cloud Keys | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Dream Machines | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Dream Routers | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Dream Wall | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Enterprise Firewall Core | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Enterprise Fortress Gateway | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Enterprise Network Attached Storage | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Enterprise Network Video Recorders | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Express 7 | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Network Attached Storage | v < 5.1.32 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | Network Video Recorders | v < 5.1.31 | CVEProject cvelistV5 (CNA) |
| Ubiquiti Inc | UniFi OS Server | v < 5.1.37 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-26
- Last updated
- 2026-08-27
- State
- Published
- Assigner (CNA)
- Ubiquiti
Exploit prediction (EPSS)
0.46%
Probability of exploitation in 30 days
40.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-284Improper Access Control - Generic