Ubiquiti vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Ubiquiti flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-34910 Ubiquiti UniFi OS Improper Input ValidationExploited since Jun 23, 2026 · CVSS 10
• CVE-2026-34909 Ubiquiti UniFi OS Path TraversalExploited since Jun 23, 2026 · CVSS 10
• CVE-2026-34908 Ubiquiti UniFi OS Improper Access ControlExploited since Jun 23, 2026 · CVSS 10
• CVE-2010-5330 Ubiquiti AirOS Command InjectionExploited since Apr 15, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-116839 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices High 7.1 · Oct 26, 2026
• CVE-2026-116838 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices High 8.8 · Oct 26, 2026
• CVE-2026-116837 A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitHigh 8.8 · Oct 26, 2026
• CVE-2026-116836 A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMHigh 8.8 · Oct 26, 2026
• CVE-2026-110459 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unHigh 8.6 · Oct 14, 2026
• CVE-2026-110455 A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI KeyHigh 8.1 · Oct 14, 2026
• CVE-2026-95862 A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of SeHigh 7.5 · Sep 22, 2026
• CVE-2026-95861 A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial ofHigh 7.5 · Sep 22, 2026
• CVE-2026-77558 A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of SerHigh 7.5 · Sep 22, 2026
• CVE-2026-77556 A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of SerHigh 7.5 · Sep 22, 2026
• CVE-2026-77555 A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of SeHigh 7.5 · Sep 22, 2026
• CVE-2026-77544 A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of SeHigh 7.5 · Sep 22, 2026
• CVE-2026-77557 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the Critical 9.8 · Aug 26, 2026
• CVE-2026-77554 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command InjecCritical 10 · Aug 26, 2026
• CVE-2026-77553 A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escaCritical 9.9 · Aug 26, 2026
• CVE-2026-77552 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Critical 9.8 · Aug 26, 2026
• CVE-2026-77551 A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Critical 9 · Aug 26, 2026
• CVE-2026-77550 A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS Critical 10 · Aug 26, 2026
• CVE-2026-77549 A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certCritical 9 · Aug 26, 2026
• CVE-2026-77548 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to eCritical 9.9 · Aug 26, 2026
• CVE-2026-77547 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCritical 9.9 · Aug 26, 2026
• CVE-2026-77546 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCritical 9.9 · Aug 26, 2026
• CVE-2026-77532 A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a ReHigh 8.8 · Aug 26, 2026
• CVE-2026-77545 A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain deviCritical 9 · Aug 26, 2026
• CVE-2026-77543 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCritical 9.9 · Aug 26, 2026