{"schemaVersion":3,"id":"CVE-2026-77550","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.","dates":{"published":"2026-08-26T10:33:29.989Z","modified":"2026-08-27T03:56:41.054Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00801,"percentile":0.55916,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.315,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00486},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00801,"percentile":0.55916}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00486,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00801,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00801,"percentile":0.55916}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences ('CRLF Injection')","description":"The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/93.html"}],"affected":[{"vendor":"ubiquiti inc","product":"cloud gateways","name":"Cloud Gateways","label":"cloud gateways","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_gateways"},{"vendor":"ubiquiti inc","product":"cloud keys","name":"Cloud Keys","label":"cloud keys","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/cloud_keys"},{"vendor":"ubiquiti inc","product":"dream machines","name":"Dream Machines","label":"dream machines","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_machines"},{"vendor":"ubiquiti inc","product":"dream routers","name":"Dream Routers","label":"dream routers","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_routers"},{"vendor":"ubiquiti inc","product":"dream wall","name":"Dream Wall","label":"dream wall","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/dream_wall"},{"vendor":"ubiquiti inc","product":"enterprise firewall core","name":"Enterprise Firewall Core","label":"enterprise firewall core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_firewall_core"},{"vendor":"ubiquiti inc","product":"enterprise fortress gateway","name":"Enterprise Fortress Gateway","label":"enterprise fortress gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_fortress_gateway"},{"vendor":"ubiquiti inc","product":"enterprise network attached storage","name":"Enterprise Network Attached Storage","label":"enterprise network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_attached_storage"},{"vendor":"ubiquiti inc","product":"enterprise network video recorders","name":"Enterprise Network Video Recorders","label":"enterprise network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/enterprise_network_video_recorders"},{"vendor":"ubiquiti inc","product":"express","name":"Express","label":"express","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.0.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.17","eol":null,"hubHref":"/vendor/ubiquiti_inc/express"},{"vendor":"ubiquiti inc","product":"express 7","name":"Express 7","label":"express 7","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/express_7"},{"vendor":"ubiquiti inc","product":"network attached storage","name":"Network Attached Storage","label":"network attached storage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.32","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_attached_storage"},{"vendor":"ubiquiti inc","product":"network video recorders","name":"Network Video Recorders","label":"network video recorders","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.31","eol":null,"hubHref":"/vendor/ubiquiti_inc/network_video_recorders"},{"vendor":"ubiquiti inc","product":"unifi os server","name":"UniFi OS Server","label":"unifi os server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.37","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_os_server"}],"affectedCount":14,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","label":"community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9","hostname":"community.ui.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-26T10:33:29.989Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-27T03:56:41.054Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:17:47.296Z","stale":false,"partial":false}}