CVE-2026-77549

CriticalCVSS 9.0/10Last modified Aug 28, 2026

Description

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2026
Last modified
Aug 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-77558.8IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server confCVE-2026-7755010.0A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devicCVE-2026-775519.0A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UnCVE-2026-775529.8A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video CVE-2026-775539.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi AccessCVE-2026-7755410.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exeCVE-2026-775557.5A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exCVE-2026-775567.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775579.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalatCVE-2026-775587.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775608.1Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverseCVE-2026-775615.3Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login req
CVE-2026-77549: Critical severity, CVSS 9.0 | Vulnix