CVE-2026-77550

State: Published
Severity: 10.0 Critical
Published: Aug 26, 2026
Updated: Aug 27, 2026
Reserved: Aug 20, 2026

Description

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	Ubiquiti

Weaknesses

CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')

Affected Products

Product	Versions
UniFi OS ServerUbiquiti Inc	before 5.1.37Affected
Cloud KeysUbiquiti Inc	before 5.1.31Affected
Network Video RecordersUbiquiti Inc	before 5.1.31Affected
Enterprise Network Video RecordersUbiquiti Inc	before 5.1.31Affected
Enterprise Network Attached StorageUbiquiti Inc	before 5.1.31Affected
Dream MachinesUbiquiti Inc	before 5.1.31Affected
Enterprise Firewall CoreUbiquiti Inc	before 5.1.31Affected
Dream RoutersUbiquiti Inc	before 5.1.31Affected
Enterprise Fortress GatewayUbiquiti Inc	before 5.1.31Affected
Cloud GatewaysUbiquiti Inc	before 5.1.31Affected
Dream WallUbiquiti Inc	before 5.1.31Affected
Express 7Ubiquiti Inc	before 5.1.31Affected
Network Attached StorageUbiquiti Inc	before 5.1.32Affected
ExpressUbiquiti Inc	before 4.0.17Affected

References

https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.