A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

CVE-2026-77540 is an Improper Input Validation vulnerability discovered in the UniFi OS Server platform. A malicious actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat, but successful exploitation could lead to arbitrary command execution on the underlying host. The issue was disclosed via the NVD and accompanied by a Ubiquiti security advisory. Organizations running UniFi OS Server should review the advisory and apply any available patches promptly. The criticality is rated High due to the potential for remote command execution.