CVE-2026-77542: Critical RCE in UID Enterprise Agent — Public PoC, KEV-Listed, Patch Now

TL;DR

CVE-2026-77542 is a critical improper input validation vulnerability in UID Enterprise Agent that allows an attacker to inject and execute operating system commands on the underlying host. Watchstack rates it Critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). A public proof-of-concept is available on GitHub, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-26). Do not wait for an EPSS spike: the EPSS score is currently low (0.00811, ~55th percentile), but the KEV listing and public PoC are stronger, more immediate signals. Inventory every host running the agent, determine who can reach its management or API interfaces, and apply the vendor patch as emergency maintenance.

What this is

CVE-2026-77542 is a remote code execution (RCE) vulnerability in UID Enterprise Agent. The flaw is an improper input validation issue that leads to command injection on the host device. In plain terms: the agent accepts input from the network and passes it into a system-level execution context without adequately neutralizing shell metacharacters or unexpected input structures. An attacker who can reach the agent and who holds high privileges can break out of the intended command and run arbitrary operating system commands.

The vulnerability was published on 2026-08-26 and was simultaneously added to the CISA KEV catalog, which means federal agencies and many private-sector defenders should treat it as actively exploited, not theoretical. A public proof-of-concept reference has appeared on GitHub, lowering the bar for less sophisticated actors.

Key facts at a glance:

• CVE: CVE-2026-77542
• Severity: Critical (CVSS 9.1)
• Type: Improper Input Validation → Command Injection (RCE)
• Affected product: UID Enterprise Agent
• Attack vector: Network (AV:N), High privileges required (PR:H), No user interaction (UI:N), Scope changed (S:C)
• Exploit status: Public PoC available; KEV-listed
• EPSS: 0.00811 (~55th percentile)

Why it matters

Three factors combine to make CVE-2026-77542 an urgent, operational problem.

First, it is remote code execution. Command injection on the host is among the most severe outcomes for a management agent. The agent typically runs with elevated privileges to perform management, discovery, or telemetry tasks. Compromise of the agent means compromise of the host.

Second, there is a public PoC. A public proof-of-concept repository on GitHub (HORKimhab/CVE-Ubiquiti) reduces the expertise required to attempt exploitation. Public PoCs often precede broader scanning and opportunistic attacks, even when the initial exploitation is targeted.

Third, it is on CISA KEV. The KEV listing is the strongest available signal that the flaw is being exploited in the wild. It also carries compliance weight: U.S. federal agencies are required to remediate KEV-listed vulnerabilities by the due date. Private-sector organizations should treat KEV as a patch-now directive.

A note on EPSS: the score is low (0.00811, ~55th percentile). This is a reminder that exploit prediction scores are not a substitute for threat intelligence. The KEV listing and public PoC outweigh the EPSS signal here. Do not deprioritize this because the EPSS number is small.

How it works

At its core, CVE-2026-77542 is a command injection weakness caused by insufficient validation or sanitization of input that the UID Enterprise Agent passes into a system-level execution context. The vulnerable component is the agent itself, which typically runs with elevated privileges on the host.

Because the agent operates across a trust boundary — accepting instructions or data from the network and then acting on the local operating system — any failure to neutralize shell metacharacters or unexpected input structures can let an attacker break out of the intended command and run arbitrary code.

The CVSS vector tells us several important things:

• AV:N (Network): the attack is reachable over the network. The agent's management or API interface is the likely entry point.
• AC:L (Low complexity): no special conditions are required; the attack is straightforward once the attacker has the necessary access.
• PR:H (High privileges): the adversary must already hold a privileged account, token, or agent-level credential. This is not an unauthenticated flaw.
• UI:N (No user interaction): no victim needs to click or approve anything.
• S:C (Scope changed): a compromise of the agent can affect resources beyond the agent's own security context — namely, the host operating system.
• C:H/I:H/A:H: high impact to confidentiality, integrity, and availability.

The exact affected version ranges, the specific parameter or endpoint that accepts the malicious input, and the underlying CWE identifier are not specified in the available intelligence. Defenders should consult the vendor advisory for authoritative version data.

Detection and response

Hypothesis: a host running UID Enterprise Agent has been reached over the network by a high-privilege account and the agent process has spawned an unexpected shell or utility.

Evidence that confirms or rejects it comes from the exposed asset, the version, and the response difference observed in telemetry. Confirm deployment and versions by inventorying UID Enterprise Agent across your estate and comparing versions to the vendor advisory. Map reachability by identifying which network segments and accounts can reach the agent's management or API interfaces, focusing on high-privilege service accounts and administrative workstations. Review authentication logs for privileged sessions that precede unexpected process creation on agent hosts. Hunt for command execution by searching for shell interpreters or utilities spawned by the agent process that are not part of normal agent behavior. Correlate network and process telemetry to tie suspicious child processes to inbound network connections to the agent's listening ports in the same time window. Check for persistence by looking for new scheduled tasks, modified services, cron jobs, systemd units, or dropped binaries on hosts running the agent. Escalate confirmed or suspected exploitation: engage incident response, isolate affected hosts, and rotate credentials the agent could access. Patch and re-scan, applying the vendor patch and re-scanning for residual indicators before returning systems to production.

Indicators cluster around unexpected process activity and post-exploitation behavior. Hunt for:

• Unexpected child processes spawned by the UID Enterprise Agent service account, especially /bin/sh, cmd.exe, powershell.exe, or bash.
• Command lines containing shell metacharacters (;, |, &&, backticks, $()) in agent-related logs or process telemetry.
• Inbound network connections to agent management ports from unusual source addresses or non-administrative subnets.
• Authentication events showing high-privilege logins immediately followed by process creation on the same host.
• New or modified persistence artifacts: cron jobs, systemd units, Windows services, or scheduled tasks on agent hosts.
• Outbound connections from agent hosts to unfamiliar external IP addresses or domains shortly after privileged activity.
• File integrity monitoring alerts on agent binaries, configuration files, or directories the agent can write to.
• EDR detections for process injection, credential access, or defense evasion on systems running the agent.

Treat any single indicator as a lead and any combination as a likely incident. Preserve logs before remediation.

What to do

1. Inventory every host running UID Enterprise Agent. Query your CMDB, endpoint management, and vulnerability scanner, and include servers, appliances, and managed endpoints. Record the agent version on each host and compare against the vendor advisory.
2. Determine which network segments and accounts can reach the agent's management or API interfaces. Identify the ports they listen on, check firewall rules, ACLs, and security group configurations for overly broad access, and focus on any exposure to untrusted segments, VPN pools, or flat internal networks.
3. Apply the vendor patch as emergency maintenance. Because this is a KEV-listed issue with a public PoC, treat the patch as emergency maintenance, not routine change management.
4. If you cannot patch immediately, restrict network access to trusted administrative subnets and enforce least privilege. Remove standing high-privilege access where possible, require strong authentication including MFA where supported, reduce agent privileges if the vendor supports running as a non-root or non-SYSTEM user, and isolate high-risk hosts reachable from untrusted segments.
5. Hunt for command execution spawned by the agent process and rotate credentials the agent could access. Confirm that process creation, authentication, and network connection logs are collected from agent hosts, and verify that EDR or equivalent telemetry is active on those hosts.
6. After patching, verify the version on each host, restart the agent, confirm that no unauthorized changes persist, and re-scan for residual indicators before returning systems to production.

FAQ

Is CVE-2026-77542 on CISA KEV? Yes. It was added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-26. That means it is treated as actively exploited.

Is there a public exploit? Yes. A public proof-of-concept reference is available on GitHub (HORKimhab/CVE-Ubiquiti). This lowers the barrier to exploitation.

What is the CVSS score? 9.1 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Does exploitation require authentication? Yes. The CVSS vector indicates high privileges are required (PR:H). The attacker must already hold a privileged account, token, or agent-level credential.

What is the EPSS score, and should I care? The EPSS score is 0.00811 (~55th percentile). It is low, but the KEV listing and public PoC are stronger indicators of risk. Do not deprioritize based on EPSS alone.

What is the impact of exploitation? Command execution on the host with the privileges of the agent process. This can lead to data theft, persistence, lateral movement, and disruption of managed services.

How do I know if I am affected? Inventory hosts running UID Enterprise Agent, check versions against the vendor advisory, and determine which network segments and accounts can reach the agent's management or API interfaces.

What should I do if I cannot patch immediately? Restrict network access to the agent's management interfaces, enforce least privilege, require strong authentication, and enable detailed logging. Isolate high-risk hosts until patching is complete.

What should I do if I suspect exploitation? Engage incident response, isolate affected hosts, preserve logs, and rotate credentials the agent could access. Hunt for persistence artifacts and outbound connections to unfamiliar destinations.

Where can I find more information? Consult the CISA KEV catalog, the NVD entry for CVE-2026-77542, the vendor advisory for version and patch details, and the public PoC reference for awareness (not for weaponization).

Sources

• CISA Known Exploited Vulnerabilities Catalog
• Watchstack CVE-2026-77542 entry
• Public proof-of-concept reference on GitHub
• NVD CVE-2026-77542