A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

CVE-2026-77535 describes an Improper Input Validation vulnerability in the UniFi Network Application by Ubiquiti. A malicious actor with high privileges and network access can exploit this flaw to perform Command Injection on an adopted device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat, but the impact on adopted network devices could be severe. Ubiquiti has published a Security Advisory Bulletin (067) addressing this issue. The vulnerability is classified as high severity. Organizations running UniFi Network Application should review the advisory and apply any recommended patches or mitigations promptly. Command injection vulnerabilities can lead to full device compromise, arbitrary code execution, and lateral movement within the network.