Ubiquiti announced on August 26, 2026 that it has released patches for three maximum‑severity vulnerabilities affecting its networking devices. The flaws allow remote attackers to take control without credentials, putting countless installations at risk. The vulnerabilities were discovered during routine security testing and affect several product lines.
CVE‑2026‑77537 enables unauthenticated attackers to execute code on unpatched devices simply by sending a crafted packet. The other two flaws, CVE‑2026‑77538 and CVE‑2026‑77539, allow privilege escalation and denial‑of‑service conditions respectively. All three can be exploited over the internet, increasing the urgency for remediation. CVE‑2026‑77538 permits remote privilege escalation, while CVE‑2026‑77539 triggers denial‑of‑service attacks that can cripple network services.
The flaw can be triggered without any user interaction, making it especially dangerous for small businesses that lack advanced monitoring. Industry analysts estimate that more than 150,000 Ubiquiti devices remain unpatched worldwide, amplifying the potential impact. We urge all customers to apply updates immediately, a spokesperson said. Delaying the patch could expose networks to active attacks within hours.
Enterprises should install the patches as soon as they become available. Segment critical systems from the internet and enforce strict firewall rules. Monitor network traffic for signs of exploitation and conduct a full security audit. Regularly review firewall logs for suspicious activity to detect early signs of exploitation.
If left unaddressed, the vulnerabilities could lead to large‑scale network breaches, data theft, or ransomware deployment. Ubiquiti expects most customers to adopt patches within weeks, but lingering exposure remains a concern. Organizations should also backup configurations before applying updates to ensure quick recovery if issues arise.
What is CVE‑2026‑77537 and why is it critical? It allows unauthenticated attackers to execute code on unpatched devices remotely. The flaw requires no credentials, making it a high‑impact threat. Which devices are covered by the security update? All UniFi routers, switches, and access points running affected firmware versions receive the fix. When will the patches be available to customers? Ubiquiti released the updates on August 26, 2026; devices should receive them automatically via the management console.