CVE-2026-77540

CriticalCVSS 9.1/10Last modified Aug 28, 2026

Description

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2026
Last modified
Aug 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-775419.1A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi NetwoCVE-2026-775429.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID EnterCVE-2026-775439.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceCVE-2026-775447.5A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exCVE-2026-775459.0A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability fCVE-2026-775469.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceCVE-2026-775479.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceCVE-2026-775489.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtCVE-2026-775499.0A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulneraCVE-2026-77558.8IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server confCVE-2026-7755010.0A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devicCVE-2026-775519.0A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un
CVE-2026-77540: Critical severity, CVSS 9.1 | Vulnix