{"schemaVersion":3,"id":"CVE-2026-77534","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.","dates":{"published":"2026-08-26T09:21:17.844Z","modified":"2026-08-27T03:56:44.534Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00468,"percentile":0.39255,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.23600000000000002,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00232},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00468,"percentile":0.39255}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00232,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00417,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00468,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00468,"percentile":0.39255}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.","type":"weakness","status":"Incomplete","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/284.html"}],"affected":[{"vendor":"ubiquiti inc","product":"cloud gateways","name":"Cloud Gateways","label":"cloud gateways","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_gateways"},{"vendor":"ubiquiti inc","product":"cloud keys","name":"Cloud Keys","label":"cloud keys","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_keys"},{"vendor":"ubiquiti inc","product":"dream machines","name":"Dream Machines","label":"dream machines","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_machines"},{"vendor":"ubiquiti inc","product":"dream routers","name":"Dream Routers","label":"dream routers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_routers"},{"vendor":"ubiquiti inc","product":"dream wall","name":"Dream Wall","label":"dream wall","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_wall"},{"vendor":"ubiquiti inc","product":"enterprise firewall core","name":"Enterprise Firewall Core","label":"enterprise firewall core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_firewall_core"},{"vendor":"ubiquiti inc","product":"enterprise fortress gateway","name":"Enterprise Fortress Gateway","label":"enterprise fortress gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_fortress_gateway"},{"vendor":"ubiquiti inc","product":"enterprise network attached storage","name":"Enterprise Network Attached Storage","label":"enterprise network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_attached_storage"},{"vendor":"ubiquiti inc","product":"enterprise network video recorders","name":"Enterprise Network Video Recorders","label":"enterprise network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_video_recorders"},{"vendor":"ubiquiti inc","product":"express 7","name":"Express 7","label":"express 7","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/express_7"},{"vendor":"ubiquiti inc","product":"network attached storage","name":"Network Attached Storage","label":"network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.32","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_attached_storage"},{"vendor":"ubiquiti inc","product":"network video recorders","name":"Network Video Recorders","label":"network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_video_recorders"},{"vendor":"ubiquiti inc","product":"unifi os server","name":"UniFi OS Server","label":"unifi os server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.37","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_os_server"}],"affectedCount":13,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","label":"community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","hostname":"community.ui.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-26T09:21:17.844Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-27T03:56:44.534Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:49:35.808Z","stale":false,"partial":false}}