CVE-2026-77552: Critical RCE in UniFi Enterprise Audio/Video Bridge — Public PoC, KEV Status Contested

TL;DR

CVE-2026-77552 is a critical improper input validation vulnerability in the UniFi Enterprise Audio/Video Bridge that allows a network-reachable attacker to execute arbitrary commands on the device. The CVSS 3.1 base score is 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — remotely reachable, low complexity, no privileges, no user interaction, and high impact across confidentiality, integrity, and availability. A public proof-of-concept repository is already circulating, which collapses the skill barrier for opportunistic actors.

Important caveat on KEV status: our source intelligence is contradictory. One feed indicates CVE-2026-77552 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26, while the Watchstack emergent-threat listing and other sources do not confirm a KEV entry. As of this writing, we cannot independently verify a KEV listing. Do not wait for KEV confirmation to act. A critical RCE with a public PoC on a network-facing AV device is an emergency regardless of catalog status.

If you run UniFi Enterprise Audio/Video Bridge hardware — especially on flat networks, guest VLANs, or anywhere an unauthenticated host can route packets to it — treat this as an active incident-response priority, not a routine patch-cycle item.

What is CVE-2026-77552?

CVE-2026-77552 is a command injection vulnerability in the UniFi Enterprise Audio/Video Bridge. According to the official summary, "a malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device."

The flaw belongs to the improper input validation family (CWE-20 and related). In practical terms, the device accepts network-supplied input and fails to sufficiently validate or sanitize it before that input reaches a command execution context. That is the classic recipe for OS command injection: attacker-controlled data flows into a shell or system call, and the attacker's commands run with the privileges of the vulnerable service.

Key attributes from the CVSS vector:

• Attack Vector: Network (AV:N) — the attacker does not need physical access or a local foothold on the device.
• Attack Complexity: Low (AC:L) — no race conditions, no heap grooming, no specialized timing.
• Privileges Required: None (PR:N) — no credentials needed.
• User Interaction: None (UI:N) — no victim has to click anything.
• Scope: Unchanged (S:U) — impact stays within the vulnerable component's security authority.
• Confidentiality / Integrity / Availability: High (C:H/I:H/A:H) — full compromise of the device's data, configuration, and operation.

Because this is a command injection rather than a memory-safety bug, exploitation does not require a crash or complex exploitation primitives. It typically requires crafting input that the device forwards into a shell or system call — exactly the kind of thing a public PoC demonstrates.

Why this matters now

Three factors combine to make CVE-2026-77552 an emergent threat rather than a theoretical one:

1. Critical severity with a trivial attack profile. A 9.8 score with AV:N/AC:L/PR:N/UI:N means any host that can reach the device can attempt exploitation. There is no authentication gate to slow an attacker down.
2. A public proof-of-concept exists. Open-source intelligence references a public PoC repository (see Additional Resources). Public exploit code converts a vulnerability from "someone might figure this out" to "anyone with a search engine can try it." Defenders should assume exploitation is accessible to a broad set of actors, including low-sophistication ones.
3. Contested KEV status. Our sources disagree on whether CISA has added CVE-2026-77552 to the KEV catalog. One feed says it was added on 2026-08-26; the Watchstack listing and other references do not confirm it. We are explicitly not asserting a KEV listing. The correct posture is to treat the vulnerability as if it were KEV-listed: assume exploitation is possible, prioritize remediation, and hunt for compromise. If KEV confirmation arrives later, you will already be ahead; if it never arrives, you will still have closed a critical RCE.

There is also a data-quality wrinkle worth flagging: some feeds list the vendor and product as "unknown." That breaks automated vulnerability management pipelines that rely on vendor/product matching. Analysts must manually map CVE-2026-77552 to Ubiquiti's UniFi Enterprise Audio/Video Bridge.

Technical details

The vulnerability is an improper input validation issue that leads to command injection. The trust boundary that matters is the network path to the device's management or service interfaces. Any host that can route packets to the bridge can potentially trigger the flaw.

What we know from source intelligence:

• Weakness class: Improper input validation (CWE-20 family), leading to OS command injection.
• Attack surface: Network-reachable service or management interface on the UniFi Enterprise Audio/Video Bridge.
• Authentication: Not required (PR:N).
• User interaction: Not required (UI:N).
• Impact: High across C/I/A — command execution with the privileges of the vulnerable service, which on embedded devices is typically privileged or root-level.

What we do not have from the available sources:

• The exact affected firmware version range is not fully specified in the source intelligence.
• The vendor field is listed as unknown in some feeds, so automated matching may fail.
• No CWE identifier is present in the source feed, though the described behavior is consistent with classic command injection via unsanitized input.

We do not reproduce exploit code or weaponized recipes here. The existence of a public PoC is the urgency signal; the defender's job is exposure validation, detection, and remediation.

Impact

Successful exploitation gives an attacker the ability to execute commands on the UniFi Enterprise Audio/Video Bridge with the privileges of the vulnerable service. On embedded AV devices, that is typically a privileged or root-level context. The consequences map directly to the high C/I/A ratings:

• Confidentiality: Access to device configuration, credentials, certificates, and potentially captured audio/video metadata. Meeting content and room telemetry may be exposed.
• Integrity: Modification of device configuration, firmware, or traffic handling. An attacker could alter how media streams are routed or recorded.
• Availability: The ability to disable the device, disrupt conferencing, or use it as a pivot. Room systems and management platforms that depend on the bridge can be taken offline.

Because the bridge sits at the boundary between the network and audio/video endpoints, a compromised device can be used to move laterally into other segments, intercept or manipulate media streams, or serve as a persistent foothold. In enterprise environments, a compromised AV bridge can also be leveraged for supply-chain-style abuse of connected room systems and management platforms.

Business exposure includes regulatory and contractual obligations around data protection, potential loss of sensitive meeting content, and operational disruption to conference rooms and collaboration spaces. Given the contested KEV status and the public PoC, defenders should consider that exploitation may already have occurred and focus on detection and containment, not just patching.

Exposure validation: how to check if you are affected

Before you can remediate, you need to know what you have and who can reach it. Work through these steps in order:

1. Inventory the device. Identify every UniFi Enterprise Audio/Video Bridge in your environment. Check asset management, network discovery, DHCP leases, and procurement records. AV devices are often managed by facilities or AV teams rather than IT security, so your CMDB may be incomplete.
2. Confirm firmware versions. Compare each device's firmware against Ubiquiti's advisory to determine whether it is in the affected range. If the advisory does not specify a range, assume all versions are affected until the vendor says otherwise.
3. Map network reachability. The vulnerability is network-reachable and requires no authentication. Determine which hosts and VLANs can route packets to the bridge. Pay special attention to flat networks, guest VLANs, and any segment where an unauthenticated host could reach the device.
4. Check external exposure. If any bridge is reachable from the internet — directly or via port forwarding — treat that as an emergency. Internet-exposed, unauthenticated RCE with a public PoC is the worst-case combination.
5. Review segmentation. If the bridge shares a VLAN with user workstations, printers, or IoT devices, an attacker on that segment can reach it. Document the blast radius.
6. Validate compensating controls. If you cannot patch immediately, confirm that firewall rules, ACLs, or VLAN isolation actually block untrusted hosts from reaching the device. Test the rules; do not assume they work.

Detection and hunting guidance

Because the flaw requires no authentication, authentication logs alone will not reveal exploitation. Hunt across device logs, network telemetry, and endpoint detection:

• Malformed input in logs. Look for HTTP or API requests containing shell metacharacters (;, |, &&, backticks, $()) in parameters that should be plain text. These are strong indicators of command injection attempts.
• Unexpected outbound connections. Monitor for connections from the bridge to internet hosts or unfamiliar internal IPs, especially on common command-and-control ports. Embedded devices should have a predictable, narrow set of outbound destinations.
• DNS anomalies. Watch for DNS queries from the bridge to domains not associated with Ubiquiti or your organization's approved services.
• File system changes. Look for new or modified files in writable directories such as /tmp, /var/tmp, or startup script locations on the device.
• Configuration drift. Detect device configuration changes that were not made by an authorized administrator, including new users, altered network settings, or disabled logging.
• Process behavior. EDR or syslog alerts showing shell execution spawned by the AV bridge service process are high-fidelity indicators.
• Availability events. Sudden reboots, crashes, or loss of availability of the bridge or connected room systems can indicate exploitation or attacker-induced instability.
• Authentication anomalies. Even though the CVE requires no auth, logins from unusual source IPs or at unusual times may indicate post-exploitation access.

If you find evidence of compromise, isolate the device, preserve volatile evidence, and rotate any credentials or certificates stored on or managed through it.

Indicators of compromise

• Unexpected outbound connections from the bridge to internet hosts or unfamiliar internal IPs, especially on common C2 ports.
• HTTP or API requests containing shell metacharacters (;, |, &&, backticks, $()) in parameters that should be plain text.
• New or modified files in writable directories such as /tmp, /var/tmp, or startup script locations on the device.
• Authentication logs showing logins from unusual source IPs or at unusual times, even though the CVE itself requires no authentication.
• Device configuration changes that were not made by an authorized administrator, including new users, altered network settings, or disabled logging.
• DNS queries from the bridge to domains not associated with Ubiquiti or your organization's approved services.
• EDR or syslog alerts showing shell execution spawned by the AV bridge service process.
• Sudden reboots, crashes, or loss of availability of the bridge or connected room systems.

Mitigation and workarounds

Patch first, but do not let a missing patch leave you exposed. Prioritize in this order:

1. Apply the fixed firmware version from Ubiquiti as soon as it is published. Consult the vendor advisory for the exact version that remediates CVE-2026-77552. If the advisory does not yet name a fixed version, escalate with the vendor and document your compensating controls.
2. Restrict network access to the bridge. Until patching is possible, allow only trusted management hosts and required AV endpoints to reach the device. This is the single most effective compensating control for a network-reachable, unauthenticated RCE.
3. Place the device on a dedicated VLAN with strict egress filtering. Block outbound traffic to the internet unless explicitly required. This limits both initial exploitation paths and post-exploitation C2.
4. Disable unused services and management interfaces. Reduce the attack surface to only what the device needs to function. Enforce strong authentication where the device supports it.
5. Monitor the CISA KEV catalog for a potential entry and align internal SLAs accordingly. If KEV confirmation arrives, federal remediation timelines may apply to your organization or your partners.
6. Consider temporary isolation or replacement of the device in high-risk environments if a patch is not yet available.
7. Rotate credentials, certificates, and API keys that were stored on or managed through the device if compromise is suspected.
8. Verify backups and configuration exports are clean before restoring them to a rebuilt device. A compromised configuration can reintroduce the attacker's foothold.

What to do in the next 24 hours

• Inventory every UniFi Enterprise Audio/Video Bridge and record firmware versions.
• Identify which hosts and VLANs can reach each device; flag any internet-exposed instances as emergencies.
• Apply network restrictions to block untrusted hosts from reaching the bridge.
• Hunt for the indicators listed above across device logs, network telemetry, and EDR.
• Open a vendor case with Ubiquiti to confirm the fixed firmware version and affected range.
• Brief AV, facilities, and IT teams on the risk and the remediation plan.

Community reactions

Security media and community trackers have highlighted CVE-2026-77552 primarily because of its critical severity and the public proof-of-concept repository referenced in open-source intelligence. The 9.8 CVSS score has reinforced the sense of urgency, and the contested KEV status has added confusion rather than calm.

Some feeds list the vendor and product as unknown, which has caused problems in automated vulnerability management pipelines. Analysts are advised to map the CVE to Ubiquiti's UniFi Enterprise Audio/Video Bridge manually and to verify KEV status directly against the CISA catalog rather than relying on third-party feeds.

Discussion in defender communities has focused on the difficulty of patching embedded AV devices that are often managed by facilities or AV teams rather than IT security, and on the need for network segmentation as a compensating control. The relatively low EPSS score (0.00893, 57.8th percentile) has been noted as a reminder that EPSS should not override severity, public exploit availability, or KEV-based prioritization. A low EPSS score reflects current exploitation telemetry, not the potential for exploitation once a PoC circulates.

Trusteed guidance

Trusteed treats CVE-2026-77552 as an emergent critical threat. Our guidance:

• Do not wait for KEV confirmation. The public PoC and critical severity are sufficient to justify emergency remediation.
• Validate exposure before you patch. Know which devices exist, what firmware they run, and who can reach them.
• Segment aggressively. Network restrictions are the most reliable compensating control for a network-reachable, unauthenticated RCE.
• Hunt for compromise. Assume exploitation may have already occurred and look for the indicators above.
• Document your decisions. If you cannot patch immediately, record the compensating controls and the residual risk.

Additional resources

• CISA Known Exploited Vulnerabilities Catalog — verify KEV status directly.
• Ubiquiti Security Advisory Portal — confirm affected versions and fixed firmware.
• NVD entry for CVE-2026-77552 — CVSS and CWE details.
• Public PoC repository referenced in open-source intelligence — reference only; do not run untrusted code.
• FIRST EPSS information — understand EPSS methodology and limitations.

FAQ

Is CVE-2026-77552 in CISA KEV? Our sources disagree. One feed indicates it was added on 2026-08-26; the Watchstack listing and other sources do not confirm a KEV entry. We cannot independently verify a KEV listing as of this writing. Verify directly against the CISA catalog and act as if it were KEV-listed.

Is there a public exploit? Yes. Open-source intelligence references a public proof-of-concept repository. We do not reproduce exploit code. Assume exploitation is accessible to a broad set of actors.

What is the CVSS score? 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What is the EPSS score? 0.00893, 57.8th percentile. EPSS is a probability estimate based on current exploitation telemetry and should not override severity, public exploit availability, or KEV-based prioritization.

Who is affected? Organizations running UniFi Enterprise Audio/Video Bridge devices, especially on flat networks, guest VLANs, or anywhere an unauthenticated host can route packets to the device.

Does exploitation require authentication? No. The CVSS vector shows PR:N and UI:N — no privileges and no user interaction.

What is the fix? Apply the fixed firmware version from Ubiquiti. Consult the vendor advisory for the exact version. Until then, restrict network access to the device and segment it on a dedicated VLAN with strict egress filtering.

How do I know if I have been compromised? Look for unexpected outbound connections, shell metacharacters in logs, new or modified files on the device, configuration drift, DNS anomalies, and shell execution spawned by the AV bridge service process. See the Indicators of Compromise section above.

Should I wait for a KEV listing before acting? No. A critical RCE with a public PoC on a network-facing device is an emergency regardless of catalog status.