Affected Vendors
- Ubiquiti — 22 CVEs (21 critical, 1 high)
- TP-Link — 4 CVEs (1 high, 3 unrated)
- ASUS — 2 CVEs (1 high, 1 unrated)
- SonicWall — 2 CVEs (2 high)
- OpenWrt / DD-WRT — 1 CVE (unrated)
- BEC — 1 CVE (1 medium)
- Fortinet — 1 CVE (1 high)
Critical Alert: Ubiquiti UniFi Ecosystem Under Siege
This week marks a significant escalation in UniFi vulnerabilities, with 22 new CVEs affecting Ubiquiti products—21 rated critical. The sheer volume and severity demand immediate attention from anyone managing UniFi infrastructure. The vulnerabilities cluster around input validation failures and privilege escalation flaws in UniFi Talk, Protect, Access, and core UniFi OS components.
The most severe issues:
- CVE-2026-77554 (CVSS 10.0) and CVE-2026-77537 (CVSS 10.0) enable remote command injection in UniFi Talk and Protect applications respectively. Any network-accessible attacker can achieve full command execution on affected devices.
- CVE-2026-77550 (CVSS 10.0) exploits CRLF sequence mishandling in UniFi OS to bypass authentication entirely—a direct path to unauthorized access without credentials.
- Multiple access control failures (CVE-2026-77553, CVE-2026-77534, CVE-2026-77536, CVSS 9.9 each) allow low-privileged network users to escalate to administrative rights.
- UniFi Access Application is targeted by at least four distinct command injection flaws (CVE-2026-77546, CVE-2026-77547, CVE-2026-77543, and others), suggesting systematic input validation failures across the application suite.
Action required: Check Ubiquiti's security advisories immediately for patch availability. If patches exist, prioritize UniFi deployments in your update schedule. If not yet available, consider network segmentation to restrict access to UniFi management interfaces and applications. Do not delay—the attack surface here is substantial.
Secondary Concerns: TP-Link, SonicWall, and Others
TP-Link disclosed four CVEs, though only one carries a formal severity rating. CVE-2026-80712 (high, CVSS 8.4) involves a Linux kernel SPI driver issue. The unrated vulnerabilities include CVE-2026-76784 (CVSS 8.7, weak cryptography in Kasa smart home devices) and command injection flaws in Archer routers (CVE-2026-78541, CVE-2026-16348)—the latter requiring administrative or authenticated access, reducing immediate risk for standard deployments.
SonicWall NetExtender Linux client users should be aware of CVE-2026-66152 (high, CVSS 8.8), a path traversal flaw allowing arbitrary file writes as root, and CVE-2026-66153 (high, CVSS 7.0), an insecure temp file handling issue in auto-upgrade. Both affect VPN client security.
ASUS, OpenWrt / DD-WRT, BEC, and Fortinet each carry minor CVEs this week with lower immediate impact, though Fortinet's CVE-2026-55841 (high, CVSS 7.5) warrants monitoring if Graylog logging integration is deployed.
Bottom line: Ubiquiti dominates this week's threat landscape. Tier your response accordingly: Ubiquiti first, TP-Link and SonicWall second, and monitor the remainder.