Ubiquiti patches three max severity security vulnerabilities

Ubiquiti disclosed and patched three maximum-severity (CVSS 10) vulnerabilities. CVE-2026-77537 is an improper input validation flaw in the UniFi Protect Application video surveillance management platform, exploitable by unauthenticated remote attackers. CVE-2026-77550 is a CRLF injection vulnerability in UniFi OS devices/instances that allows remote, unprivileged attackers to bypass authentication by exploiting improper neutralization of CRLF sequences. CVE-2026-77554 is a command injection flaw stemming from improper input validation in the UniFi Talk Application VoIP phone system. All three vulnerabilities can be exploited remotely without authentication, require low attack complexity, and do not require user interaction. Additionally, Ubiquiti patched 18 critical-severity issues on the same day affecting UniFi OS Server, UniFi Network Application, UniFi Protect AI Key, and various routers, gateways, NAS, and surveillance systems. Over 100,000 UniFi OS instances are exposed on the internet according to Censys. Previously, similar UniFi OS vulnerabilities were chained to achieve remote code execution with elevated privileges. The Moobot botnet, used by Russian GRU, previously leveraged Ubiquiti devices for cyberespionage operations.