CVE-2026-77555

HighCVSS 7.5/10Last modified Sep 22, 2026

Description

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
Ubiquiti IncDream Machines< 5.1.31
Ubiquiti IncEnterprise Firewalls< 5.1.31
Ubiquiti IncDream Routers< 5.1.31
Ubiquiti IncCloud Gateways< 5.1.31
Ubiquiti IncDream Wall< 5.1.31
Ubiquiti IncExpress< 4.0.21
Ubiquiti IncExpress 7< 5.1.31
Ubiquiti IncUniFi Gateways< 5.1.26

References

Timeline

Published
Sep 22, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-775567.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775579.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalatCVE-2026-775587.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeCVE-2026-775608.1Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverseCVE-2026-775615.3Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login reqCVE-2026-775643.3Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field fCVE-2026-775678.1Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenCVE-2026-775723.3VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the CVE-2026-775733.5Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted CVE-2026-775818.6BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/coCVE-2026-775826.9Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between autCVE-2026-775848.2Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client coul