CVE-2026-77536
Status: DeferredCritical (9.9)—
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Base score: 9.9
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.42%
- Percentile among all scored CVEs: 34
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1210Exploitation of Remote Serviceslateral movement85 % - Primary impact
T1068Exploitation for Privilege Escalationprivilege escalation90 %
Vector CVSS AV:N/AC:L con PR:L (red, requiere privilegios bajos) y CWE-284 (acceso impropio) indica explotación de servicio remoto (T1210). El texto menciona escalada de privilegios explícitamente, resultando en T1068 como impacto primario; el acceso con privilegios mejorados habilita T1078 (acceso
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-284
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-77536",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-77536",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-08-26T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.9,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"affectedData": [
{
"vendor": "Ubiquiti Inc",
"product": "UniFi OS Server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.37",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Cloud Keys",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Network Video Recorders",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Enterprise Network Video Recorders",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Enterprise Network Attached Storage",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Dream Machines",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Enterprise Firewall Core",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Dream Routers",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Enterprise Fortress Gateway",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Cloud Gateways",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Dream Wall",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Express 7",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.31",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "Network Attached Storage",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.32",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-08-26T10:16:41.417",
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9",
"source": "fe490ce8-0395-4072-90d8-2707e1bdf984"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances."
}
],
"lastModified": "2026-08-28T18:49:15.340",
"sourceIdentifier": "fe490ce8-0395-4072-90d8-2707e1bdf984"
}