CVE-2026-77554

CriticalCVSS 10.0/10Last modified Aug 28, 2026

Description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Ubiquiti IncUniFi Talk Application< 5.3.2

References

Timeline

Published
Aug 26, 2026
Last modified
Aug 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-775557.5A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exCVE-2026-775567.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775579.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalatCVE-2026-775587.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775608.1Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverseCVE-2026-775615.3Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login reqCVE-2026-775643.3Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field fCVE-2026-775678.1Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenCVE-2026-775723.3VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the CVE-2026-775733.5Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted CVE-2026-775818.6BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/coCVE-2026-775826.9Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between aut
CVE-2026-77554: Critical severity, CVSS 10.0 | Vulnix