Read the docs
TI-2026-54056 Aliases CVE-2026-77536GHSA-v2rq-v496-h267

Improper access control in Ubiquiti UniFi OS Server

Priority MEDIUM 43CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.1.37Cloud Keys (Ubiquiti Inc): 5.1.31+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUniFi OS Serverbefore 5.1.375.1.37Patch availableCNA
UbiquitiCloud Keysbefore 5.1.315.1.31Patch availableCNA
UbiquitiNetwork Video Recordersbefore 5.1.315.1.31Patch availableCNA
UbiquitiEnterprise Network Video Recordersbefore 5.1.315.1.31Patch availableCNA
UbiquitiEnterprise Network Attached Storagebefore 5.1.315.1.31Patch availableCNA
UbiquitiDream Machinesbefore 5.1.315.1.31Patch availableCNA
UbiquitiEnterprise Firewall Corebefore 5.1.315.1.31Patch availableCNA
UbiquitiDream Routersbefore 5.1.315.1.31Patch availableCNA
UbiquitiEnterprise Fortress Gatewaybefore 5.1.315.1.31Patch availableCNA
UbiquitiCloud Gatewaysbefore 5.1.315.1.31Patch availableCNA
UbiquitiDream Wallbefore 5.1.315.1.31Patch availableCNA
UbiquitiExpress 7before 5.1.315.1.31Patch availableCNA
UbiquitiNetwork Attached Storagebefore 5.1.325.1.32Patch availableCNA
  • UniFi OS Server VendorUbiquiti Affected before 5.1.37 Fixed in 5.1.37 Patch available CNA
  • Cloud Keys VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Network Video Recorders VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Enterprise Network Video Recorders VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Enterprise Network Attached Storage VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Dream Machines VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Enterprise Firewall Core VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Dream Routers VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Enterprise Fortress Gateway VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Cloud Gateways VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Dream Wall VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Express 7 VendorUbiquiti Affected before 5.1.31 Fixed in 5.1.31 Patch available CNA
  • Network Attached Storage VendorUbiquiti Affected before 5.1.32 Fixed in 5.1.32 Patch available CNA

Remediation

  • Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.1.37
  • Fix · CNA Cloud Keys (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Network Video Recorders (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Enterprise Network Video Recorders (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Enterprise Network Attached Storage (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Dream Machines (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Enterprise Firewall Core (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Dream Routers (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Enterprise Fortress Gateway (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Cloud Gateways (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Dream Wall (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.31
  • Fix · CNA Network Attached Storage (Ubiquiti Inc) Fixed in 5.1.32

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti UniFi OS Server 5.1.37

    7 records Highest priority Priority MEDIUM 7 MEDIUM

    Other records, highest priority first

    • TI-2026-54070 A malicious actor with access to the network could exploit an Improper Neutralization of…Priority MEDIUM 50
    • TI-2026-54060 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
    • TI-2026-54059 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
    Show all 7 records →
  • Release ·

    Ubiquiti Cloud Gateways, Cloud Keys and 10 more products 5.1.31, 5.1.32

    5 records Highest priority Priority MEDIUM 5 MEDIUM

    Other records, highest priority first

    • TI-2026-54070 A malicious actor with access to the network could exploit an Improper Neutralization of…Priority MEDIUM 50
    • TI-2026-54054 Improper access control in Ubiquiti UniFi OS ServerPriority MEDIUM 43
    • TI-2026-54069 A malicious actor with access to the network and under certain conditions could exploit…Priority MEDIUM 41
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77536
  2. 2026-10-03 Alias added: GHSA-v2rq-v496-h267

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences