CVE-2026-77549: ubiquiti inc cloud gateways CRLF Injection

Vulnerability summary

CVE-2026-77549 is a critical (CVSS 9.0) CRLF Injection vulnerability in ubiquiti inc cloud gateways. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities.

Timeline

1. 26-08-2026
   PublishedVulnerability first disclosed.
2. 27-08-2026
   Last modifiedVulnerability information updated.

Description

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.