CVE-2026-77536
A malicious actor with access to the network and low privileges could exploit an Improper Access...
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
CVE-2026-77536- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-66363
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
EUVD-2026-66363- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v2rq-v496-h267
A malicious actor with access to the network and low privileges could exploit an Improper Access...
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
GHSA-v2rq-v496-h267- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Record
CVE-2026-77536- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
- ubiquiti inc cloud gateways
- ubiquiti inc cloud keys
- ubiquiti inc dream machines
- ubiquiti inc dream routers
- ubiquiti inc dream wall
- ubiquiti inc enterprise firewall core
- ubiquiti inc enterprise fortress gateway
- ubiquiti inc enterprise network attached storage
- ubiquiti inc enterprise network video recorders
- ubiquiti inc express 7
- ubiquiti inc network attached storage
- ubiquiti inc network video recorders
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-77536 is a critical vulnerability (CVSS 9.9) in Ubiquiti Inc Cloud Gateways, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.