CVE-2026-77554: Critical UniFi Talk Command Injection RCE With Public PoC — Patch Now

TL;DR

CVE-2026-77554 is a CVSS 10.0 improper input validation vulnerability in the UniFi Talk application that leads to OS command injection and remote code execution on the host device. The attack is network-reachable, requires no authentication, and needs no user interaction. A public proof-of-concept repository is already available on GitHub, and CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26. If you run UniFi Talk — especially on a flat network or with any internet-facing management interface — treat this as an emergency patch item. Validate exposure now, apply the vendor fix, and hunt for command-injection artifacts and post-exploitation behavior on the appliance.

What is CVE-2026-77554?

CVE-2026-77554 is a command injection vulnerability in the UniFi Talk application, caused by improper validation of attacker-supplied input. According to the official summary, "a malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in the UniFi Talk Application to execute a Command Injection on the host device."

The flaw maps to the CWE-20 (Improper Input Validation) family and manifests as CWE-78 (OS Command Injection). In practice, the application accepts input from a network-reachable interface and passes it — insufficiently sanitized — into a shell or system-level command execution context. Because the input is not properly constrained, an attacker can inject shell metacharacters or command separators that the host operating system interprets as commands rather than inert data.

The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which yields a base score of 10.0 (Critical). That vector tells a clear story:

• AV:N (Network) — exploitable remotely over the network.
• AC:L (Low) — no special conditions or race windows required.
• PR:N (None) — no authentication needed.
• UI:N (None) — no user interaction required.
• S:C (Changed) — a compromise of the vulnerable component can affect resources beyond its original security authority, i.e., the host device itself.
• C:H / I:H / A:H — high impact to confidentiality, integrity, and availability.

Although the NVD/source severity field is listed as UNKNOWN in some feeds, the vendor-agnostic CVSS scoring and the KEV listing make the operational priority unambiguous. The exact affected version range is not specified in the available source intelligence, so defenders should assume all currently deployed UniFi Talk versions are potentially vulnerable until the vendor confirms otherwise.

Why this is an emergent threat

Three factors combine to make CVE-2026-77554 an emergent threat rather than a routine patch item:

1. Critical RCE with a trivial attack path. A CVSS 10.0 network-reachable, unauthenticated command injection is about as severe as it gets. There is no credential barrier and no user-interaction barrier for an attacker to clear.
2. Public proof-of-concept. A public PoC repository is referenced in threat intelligence (see the GitHub link in Additional Resources). Public exploit code lowers the barrier to entry for opportunistic actors, script kiddies, and automated scanners. Once a PoC is public, exploitation attempts typically follow within hours to days.
3. CISA KEV listing. CISA added CVE-2026-77554 to the Known Exploited Vulnerabilities catalog on 2026-08-26. A KEV listing signals that exploitation has been observed in the wild or that the risk is considered urgent by U.S. federal guidance. For federal civilian agencies, KEV inclusion triggers a binding remediation deadline; for everyone else, it is a strong signal to treat the vulnerability as actively targeted.

Note on the EPSS score: the current EPSS score is 0.00992, around the 61st percentile. That is a modest probabilistic score. However, EPSS is a probability of exploitation in the next 30 days based on observed activity, and it often lags behind fast-moving events. The KEV listing and public exploit availability outweigh the probabilistic score for prioritization purposes. Do not let a low EPSS number talk you out of patching this.

Technical details

At its core, CVE-2026-77554 is an improper input validation weakness that leads to OS command injection. The UniFi Talk application accepts input from a network-reachable interface and passes it, insufficiently sanitized, into a shell or system-level command execution context. Because the input is not properly constrained, an attacker can inject shell metacharacters or command separators that are interpreted by the host operating system rather than treated as inert data.

The attack prerequisites are relatively low:

• Network reachability to the vulnerable service. This could be the management interface, the application service port, or any other network-reachable component of UniFi Talk that accepts input.
• No authentication required, according to the CVSS vector.
• No user interaction required.

The scope change (S:C) is significant. It indicates that a compromise of the vulnerable component can affect resources beyond its original security authority — in practice, the host device itself. Trust boundaries are crossed when untrusted network input is allowed to influence command execution on the appliance.

No CWE identifier was formally assigned in the source data, but the behavior maps cleanly to command injection via input validation failure. The exact affected version range is not specified in the available source intelligence, so defenders should assume all currently deployed UniFi Talk versions are potentially vulnerable until the vendor confirms otherwise.

Impact

Successful exploitation gives the attacker arbitrary command execution on the host device with the privileges of the vulnerable service. In realistic terms, this means an adversary could:

• Read or exfiltrate configuration data, credentials, call metadata, and potentially recordings or voicemail content handled by the UniFi Talk application.
• Modify application files, alter configuration, or plant persistence mechanisms, given the high integrity impact.
• Terminate services, corrupt data, or use the host as a pivot point, given the high availability impact.

Because the scope is changed, the compromised appliance can be used to reach other systems on the same network segment — a serious concern in flat corporate or residential networks where the UniFi Talk host sits alongside workstations and servers. Downstream abuse scenarios include lateral movement, use of the device as a command-and-control relay, or staging further exploitation against UniFi management interfaces.

For defenders, the business exposure includes loss of communications confidentiality, regulatory implications for recorded calls, and potential disruption of voice services. In environments where UniFi Talk handles sensitive conversations, the confidentiality impact alone may trigger breach-notification obligations depending on jurisdiction and data type.

Exposure validation: how to check if you are affected

Before you can patch, you need to know what you have. Run through this checklist:

1. Inventory UniFi Talk instances. Search your asset inventory, CMDB, and network scans for UniFi Talk hosts. Include appliances, VMs, and any containerized deployments. Do not assume your inventory is complete — validate with active discovery.
2. Identify network reachability. For each instance, determine who can reach the management and application interfaces. Is it restricted to a management VLAN, or is it reachable from user subnets, guest networks, or the internet? Internet-exposed instances are the highest priority.
3. Check version and patch status. Compare the deployed version against the vendor's advisory. If the vendor has not yet published a fixed version, assume the instance is vulnerable.
4. Review firewall and segmentation rules. Look for any allow rules that permit broad access to UniFi Talk ports. Flat networks are the worst case — a single compromised workstation can reach the appliance.
5. Check for prior exploitation. Review logs for command-injection artifacts (see Indicators of Compromise below). If you find evidence of exploitation, escalate to incident response immediately.
6. Confirm KEV-driven SLAs. If you are a federal agency or a contractor subject to KEV requirements, align your remediation timeline with the CISA deadline. For everyone else, treat this as an emergency change.

Detection and hunting guidance

Because a public PoC exists, defenders should expect automated scanning and exploitation attempts against exposed instances. Build detections around the following:

Indicators of compromise

• Unexpected outbound connections from the UniFi Talk host to unfamiliar IP addresses or domains, especially on non-standard ports.
• Child processes spawned by the UniFi Talk application or its web/service components (for example, shell interpreters invoked by a web process).
• Log entries showing shell metacharacters (;, |, &&, backticks, $()) in request parameters or application logs.
• New or modified files in application directories, cron jobs, systemd units, or startup scripts on the host.
• Authentication or configuration changes that were not performed by an authorized administrator.
• EDR alerts for command interpreters (sh, bash, cmd.exe) launched by the UniFi Talk service account.
• Anomalous DNS queries or beaconing patterns originating from the appliance.
• Sudden service restarts, crashes, or degraded voice functionality that coincide with suspicious network activity.

Hunting queries and telemetry

• Process lineage: Alert on shell interpreters (sh, bash, dash, cmd.exe) whose parent process is the UniFi Talk application, its web server, or its service wrapper. This is the single highest-fidelity signal for command injection.
• Network egress: Baseline normal egress from the UniFi Talk host. Alert on new destinations, especially on ports 80/443/53 to unfamiliar infrastructure, and on raw IP connections.
• File integrity: Monitor application directories, /etc/cron*, systemd unit paths, and startup scripts for unexpected modifications.
• Web/application logs: Search for encoded or raw shell metacharacters in request parameters. Note that attackers may URL-encode or double-encode payloads, so normalize before matching.
• Authentication logs: Alert on new admin accounts, password changes, or API token creation outside change windows.

Post-exploitation triage

If you confirm exploitation, assume the attacker had command execution with the privileges of the vulnerable service. Triage accordingly:

1. Isolate the appliance from the network without powering it off, to preserve volatile evidence.
2. Capture memory, process listings, network connections, and relevant logs before remediation.
3. Rotate any credentials, API keys, or tokens that were stored on or accessible from the appliance.
4. Review the appliance's network neighbors for signs of lateral movement.
5. Rebuild the appliance from a known-good image rather than attempting to clean it in place.

Mitigation and workarounds

Apply the vendor-supplied patch for UniFi Talk as soon as it is available; given the CISA KEV listing, this should be treated as an emergency change. If a fixed version is not yet published, use the following compensating controls:

• Restrict network access. Use firewall rules, VLAN segmentation, and allowlists so that only trusted administrative hosts can reach the UniFi Talk management and application interfaces.
• Remove internet exposure. Eliminate any direct internet exposure of the UniFi Talk interface. If remote access is required, require VPN or zero-trust access with strong authentication.
• Enforce strong authentication. Monitor administrative accounts for unauthorized changes. Disable default or shared credentials.
• Segment the host. Run the UniFi Talk host on a segmented network with strict egress filtering to limit post-exploitation movement.
• Enable detailed logging. Forward logs to a SIEM so that injection attempts and anomalous child processes are visible.
• Align with KEV deadlines. Review the CISA KEV entry for the required remediation deadline and align internal SLAs accordingly.
• Consider host-based controls. Host-based intrusion detection or application allowlisting on the appliance can block unexpected command execution as a compensating control.

Patch and remediation guidance

1. Prioritize by exposure. Internet-facing or broadly reachable UniFi Talk instances first, then flat-network deployments, then segmented instances.
2. Apply the vendor fix. Check the Ubiquiti security advisory portal for the fixed version and upgrade instructions. Follow the vendor's guidance exactly — do not improvise.
3. Verify the fix. After patching, confirm the running version and re-test network reachability to ensure the attack surface is reduced.
4. Rotate secrets. If the appliance was exposed, rotate credentials, API keys, and any secrets stored on or accessible from the host.
5. Re-scan. Run an authenticated and unauthenticated scan against the patched host to confirm the vulnerability is no longer present.
6. Document and report. Record the patch date, version, and any indicators of prior exploitation. If exploitation is confirmed, follow your incident response and breach-notification processes.

Timeline

• 2026-08-26 — CVE-2026-77554 published; CISA adds it to the Known Exploited Vulnerabilities catalog. Public PoC repository referenced in threat intelligence.
• Ongoing — Watchstack tracks the CVE as Critical severity with a public PoC and RCE tag. EPSS score 0.00992 (61st percentile) as of the latest feed.

Community reactions

Security media and community trackers have flagged CVE-2026-77554 as critical, with a CVSS score of 10.0 and a public proof-of-concept repository on GitHub. The simultaneous addition to the CISA KEV catalog on the disclosure date amplified urgency across defender communities, and the presence of a PoC lowered the barrier for opportunistic attackers.

Discussion has focused on the risks of exposing UniFi management interfaces to untrusted networks and on the need for rapid patching of edge and voice appliances. While the EPSS score is currently modest (0.00992, around the 61st percentile), the KEV listing and public exploit availability outweigh the probabilistic score for prioritization purposes. Community sentiment emphasizes segmentation and monitoring as essential complements to patching.

Trusteed take

CVE-2026-77554 is a textbook emergent threat: critical severity, network-reachable, unauthenticated, public PoC, and KEV-listed. The combination of a CVSS 10.0 and a public exploit means the window between disclosure and exploitation is effectively zero. Defenders should not wait for a vendor patch to reduce exposure — restrict network access to UniFi Talk interfaces immediately, then patch as soon as a fixed version is available.

The most common failure mode in situations like this is assuming the appliance is "internal" and therefore safe. Flat networks and overly permissive firewall rules turn an internal appliance into a reachable target. Validate exposure from the attacker's perspective: what can reach the UniFi Talk service, and with what privileges?

Finally, treat detection as a first-class control. Because exploitation may already have occurred before you patch, hunting for command-injection artifacts and post-exploitation behavior is essential. If you find evidence of compromise, escalate to incident response and assume the host is untrusted.

FAQ

Is CVE-2026-77554 in CISA KEV? Yes. CISA added CVE-2026-77554 to the Known Exploited Vulnerabilities catalog on 2026-08-26. KEV inclusion signals that exploitation has been observed in the wild or that the risk is considered urgent by U.S. federal guidance.

Is there a public exploit for CVE-2026-77554? Yes. A public proof-of-concept repository is referenced in threat intelligence. Public exploit code lowers the barrier to entry for opportunistic actors and automated scanners.

What is the CVSS score for CVE-2026-77554? The CVSS v3.1 base score is 10.0 (Critical), with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Does exploitation require authentication? No. According to the CVSS vector, the attack requires no authentication (PR:N) and no user interaction (UI:N). The attacker only needs network reachability to the vulnerable service.

What is the EPSS score for CVE-2026-77554? The current EPSS score is 0.00992, around the 61st percentile. EPSS is a probabilistic score and can lag behind fast-moving events; the KEV listing and public PoC should drive prioritization.

Which versions of UniFi Talk are affected? The exact affected version range is not specified in the available source intelligence. Defenders should assume all currently deployed UniFi Talk versions are potentially vulnerable until the vendor confirms otherwise.

What should I do if I cannot patch immediately? Restrict network access to the UniFi Talk management and application interfaces using firewall rules, VLAN segmentation, and allowlists. Remove any direct internet exposure. Enable detailed logging and monitor for command-injection artifacts and anomalous child processes.

How do I know if I have been exploited? Look for unexpected outbound connections, shell interpreters spawned by the UniFi Talk service, shell metacharacters in logs, new or modified files in application directories, and unauthorized configuration changes. If you find evidence of exploitation, escalate to incident response immediately.

Where can I find the official advisory? Check the Ubiquiti security advisory portal at https://www.ui.com/security-advisories and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-77554.

Additional resources

• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Public proof-of-concept repository referenced in intelligence: https://github.com/HORKimhab/CVE-Ubiquiti
• NVD entry for CVE-2026-77554: https://nvd.nist.gov/vuln/detail/CVE-2026-77554
• Ubiquiti security advisory portal: https://www.ui.com/security-advisories