A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

CVE-2026-77539 is an Improper Input Validation vulnerability affecting the UniFi OS Server. A threat actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges, limiting the attack surface but still posing significant risk in environments where privilege escalation is possible. Ubiquiti has published a security advisory bulletin addressing this issue. The vulnerability is classified as high severity given the potential for arbitrary command execution on affected devices. Organizations using UniFi OS Server should apply patches or mitigations as soon as available.