CVE-2026-77553

CriticalCVSS 9.9/10Last modified Aug 28, 2026

Description

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-7755410.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exe CVE-2026-775557.5A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex CVE-2026-775567.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe CVE-2026-775579.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalat CVE-2026-775587.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe CVE-2026-775608.1Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse CVE-2026-775615.3Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login req CVE-2026-775643.3Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field f CVE-2026-775678.1Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challen CVE-2026-775723.3VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the CVE-2026-775733.5Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted CVE-2026-775818.6BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/co