CVE-2026-77543: Critical RCE in UniFi Access Application With Public PoC — Patch Now

TL;DR

CVE-2026-77543 is a critical improper input validation vulnerability in the UniFi Access Application that allows a low-privileged, network-reachable attacker to execute commands on the underlying host. The CVSS v3.1 base score is 9.9 (Critical), a public proof-of-concept reference has been observed on GitHub, and the vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26. If you run UniFi Access in production, assume it is a target and prioritize remediation immediately. The EPSS score is low at 0.00804 (55th percentile), but KEV status and the public PoC override statistical scoring for prioritization.

A low-privileged user who can reach the app can turn failed input checks into host execution.

What this is

CVE-2026-77543 is an improper input validation flaw in the UniFi Access Application, a physical access control platform widely deployed in offices, campuses, and multi-tenant buildings. According to the official summary, a malicious actor with network access and low privileges can exploit the flaw to perform command injection on the host device. The vulnerability maps to CWE-20 (Improper Input Validation) and CWE-78 (OS Command Injection).

The source intelligence does not name the vendor explicitly, but the product family — UniFi Access — is clearly identified. Defenders should treat this as a Ubiquiti product until the vendor advisory confirms otherwise. The lack of complete vendor attribution in the feed is a data quality issue, not a reason to delay action.

The affected version range is not specified in the source intelligence. Defenders must consult the vendor advisory to determine exactly which UniFi Access Application builds are impacted. Until that is confirmed, assume all versions are potentially vulnerable and apply the vendor-supplied fix as soon as it is available.

Why it matters

Access control systems sit at the intersection of IT and physical security. A command injection flaw in UniFi Access is not just another web application bug — it can translate into unauthorized door access, denial of legitimate entry, or a foothold for lateral movement into the management network. A compromised access controller is both an IT breach and a physical-security failure.

The CVSS vector tells a specific story:

• AV:N (Network): Exploitable remotely over the network.
• AC:L (Low complexity): No special conditions required.
• PR:L (Low privileges): The attacker needs a valid low-privileged account, not admin.
• UI:N (No user interaction): No victim needs to click anything.
• S:C (Scope Changed): The vulnerable component can affect resources beyond its own security authority — in this case, the host operating system.
• C:H/I:H/A:H: High impact on confidentiality, integrity, and availability.

That combination — network reachable, low privilege, no interaction, scope change — is why the score is 9.9. The prerequisite of a low-privileged account is meaningful, but in many environments, access control systems share a management VLAN with other infrastructure, and guest or contractor accounts may exist. That makes the barrier lower than it first appears.

How it works

The root cause is improper input validation that allows attacker-controlled data to reach a command execution context on the host device. The application fails to sufficiently constrain or sanitize input before passing it to a system-level operation. This is consistent with CWE-20 (Improper Input Validation) and CWE-78 (OS Command Injection).

The trust boundary that is crossed is between the web/application layer and the host operating system. That is why the impact is rated high across all three security objectives. Once an attacker can execute commands on the host, they can read configuration data, credentials, and integration secrets; modify application behavior; and disrupt the availability of the access control service.

The affected version range is not specified in the source intelligence. Consult the vendor advisory for exact version information.

Detection and response

The hypothesis to test is whether a low-privileged, network-reachable account can drive attacker-controlled input into a host command execution context on your UniFi Access deployment.

Because a public PoC exists, detection should focus on both exploitation attempts and post-exploitation activity. The following indicators are worth hunting for:

• Unexpected child processes spawned by the UniFi Access service, such as /bin/sh, cmd.exe, powershell.exe, or curl/wget.
• Web or application log entries containing shell metacharacters (;, |, &&, backticks, $()) in parameters tied to input handling.
• Authentication events from low-privileged accounts at unusual hours or from unexpected network ranges.
• Outbound network connections from the UniFi Access host to IP addresses or domains not present in the approved integration baseline.
• New or modified files in application, temporary, or persistence directories on the host.
• Sudden changes to access control configuration, door schedules, or badge permissions that were not authorized.
• Gaps or anomalies in physical access logs that coincide with application restarts or service interruptions.
• EDR alerts for process injection, credential access, or lateral movement originating from the UniFi Access host.

If you find evidence of command execution, treat the host as compromised. Isolate it from the network, preserve logs and forensic evidence, and rebuild from a known-good image rather than attempting in-place cleanup.

What to do

1. Confirm exposure. Determine whether UniFi Access is deployed and who can reach it, including test, staging, and forgotten pilots.
2. Check for exploitation. Hunt for the indicators above, especially child processes and unusual outbound connections.
3. Patch or mitigate. Apply the vendor-supplied fix for CVE-2026-77543 as soon as it is available and verify the installed build against the official advisory. If immediate patching is not possible, restrict network access to trusted administrative networks and jump hosts, enforce least privilege on application accounts, segment the host on a dedicated management VLAN with strict egress filtering, and document compensating controls with a hard remediation deadline.
4. Rotate credentials. Assume any secrets stored on or accessible from the host may be compromised, and rotate credentials and API tokens.
5. Review physical security impact. Check door schedules, badge permissions, and access logs for unauthorized changes.
6. Document and report. If you confirm exploitation, follow your incident response process and consider notifying relevant stakeholders, including physical security and compliance teams.

FAQ

Is CVE-2026-77543 in CISA KEV?

Yes. It was added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-26. That means CISA has evidence of active exploitation in the wild.

Is there a public proof-of-concept?

Yes. A public PoC reference has been observed on GitHub. Defenders should assume that exploitation attempts will increase.

What is the CVSS score?

The CVSS v3.1 base score is 9.9 (Critical) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

What is the EPSS score?

The EPSS score is 0.00804, which is the 55th percentile. This is a low probability estimate, but KEV status and the public PoC override statistical scoring for prioritization purposes.

Which versions are affected?

The affected version range is not specified in the source intelligence. Consult the vendor advisory for exact version information.

Who is the vendor?

Vendor attribution in the source feed is incomplete, but the affected product is identified as the UniFi Access Application. Treat this as a Ubiquiti product until the vendor advisory confirms otherwise.

What is the attack prerequisite?

The attacker needs network access to the application and a valid low-privileged account. No user interaction is required.

What is the impact?

Successful exploitation gives the attacker command execution on the host device. From there, they can read sensitive data, modify application behavior, disrupt access control services, and pivot into the broader network.

How do I mitigate if I cannot patch immediately?

Restrict network access to trusted administrative networks, enforce least privilege, segment the host, rotate credentials, and monitor for the indicators listed above. Document compensating controls and set a hard deadline for patching.

What should I do if I suspect compromise?

Isolate the host, preserve logs and forensic evidence, and rebuild from a known-good image. Do not attempt in-place cleanup. Follow your incident response process and notify relevant stakeholders.

Sources

• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Public PoC reference on GitHub: https://github.com/HORKimhab/CVE-Ubiquiti
• NVD entry for CVE-2026-77543: https://nvd.nist.gov/vuln/detail/CVE-2026-77543
• CWE-20 Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CWE-78 OS Command Injection: https://cwe.mitre.org/data/definitions/78.html