CVE-2026-77547 describes a critical vulnerability in Ubiquiti's UniFi Access Application involving Improper Input Validation that enables Command Injection. A threat actor with low privileges and network access can exploit this flaw to execute arbitrary commands on the host device. The vulnerability does not require high-level credentials, lowering the barrier for exploitation. It was published via the NVD and accompanied by a Ubiquiti Security Advisory Bulletin. The affected product is the UniFi Access Application, commonly deployed in physical access control environments. The low privilege requirement combined with command injection potential makes this a high-severity issue. Organizations using UniFi Access should apply patches or mitigations immediately. The attack vector is network-based, increasing the potential scope of exploitation.
