A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

CVE-2026-77548 is a high-severity vulnerability affecting the UniFi Protect Application by Ubiquiti. The flaw stems from Improper Input Validation, allowing a malicious actor with low privileges and network access to perform Command Injection on the host device. This type of vulnerability can lead to full system compromise, remote code execution, and lateral movement within the network. The attack vector requires only low privileges, making it accessible to a broad range of potential threat actors. Ubiquiti has published a security advisory bulletin detailing the issue. Users of UniFi Protect are strongly advised to apply available patches immediately. The vulnerability is catalogued in the NVD and has been assessed with a high criticality rating.