{"schemaVersion":3,"id":"CVE-2026-77545","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.","dates":{"published":"2026-08-26T10:13:43.772Z","modified":"2026-08-27T03:56:56.210Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00392,"percentile":0.31872,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.178,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00214},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00392,"percentile":0.31872}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00214,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00392,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00392,"percentile":0.31872}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-489","name":"Active Debug Code","description":"The product is released with debugging code still enabled or active.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/489.html"}],"affected":[{"vendor":"ubiquiti inc","product":"cloud gateways","name":"Cloud Gateways","label":"cloud gateways","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_gateways"},{"vendor":"ubiquiti inc","product":"cloud keys","name":"Cloud Keys","label":"cloud keys","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_keys"},{"vendor":"ubiquiti inc","product":"dream machines","name":"Dream Machines","label":"dream machines","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_machines"},{"vendor":"ubiquiti inc","product":"dream routers","name":"Dream Routers","label":"dream routers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_routers"},{"vendor":"ubiquiti inc","product":"dream wall","name":"Dream Wall","label":"dream wall","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_wall"},{"vendor":"ubiquiti inc","product":"enterprise firewall core","name":"Enterprise Firewall Core","label":"enterprise firewall core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_firewall_core"},{"vendor":"ubiquiti inc","product":"enterprise fortress gateway","name":"Enterprise Fortress Gateway","label":"enterprise fortress gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_fortress_gateway"},{"vendor":"ubiquiti inc","product":"enterprise network attached storage","name":"Enterprise Network Attached Storage","label":"enterprise network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_attached_storage"},{"vendor":"ubiquiti inc","product":"enterprise network video recorders","name":"Enterprise Network Video Recorders","label":"enterprise network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_video_recorders"},{"vendor":"ubiquiti inc","product":"express 7","name":"Express 7","label":"express 7","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/express_7"},{"vendor":"ubiquiti inc","product":"network attached storage","name":"Network Attached Storage","label":"network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.32","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_attached_storage"},{"vendor":"ubiquiti inc","product":"network video recorders","name":"Network Video Recorders","label":"network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_video_recorders"},{"vendor":"ubiquiti inc","product":"unifi os server","name":"UniFi OS Server","label":"unifi os server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.37","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_os_server"}],"affectedCount":13,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","label":"community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","hostname":"community.ui.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-26T10:13:43.772Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-27T03:56:56.210Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T11:43:30.351Z","stale":false,"partial":false}}