CVE-2026-77533: UniFi Protect Command Injection via Improper Input Validation

Overview

Ubiquiti has disclosed CVE-2026-77533, a critical Improper Input Validation vulnerability (CWE-20) in the UniFi Protect Application that allows a network-adjacent attacker with only low privileges to execute arbitrary Command Injection on the host device. The flaw carries a CVSS score of 9.9 and was published in Ubiquiti's Security Advisory Bulletin 067 on August 26, 2026.

CVE-2026-77533 is one of several command-injection issues disclosed in the same bulletin (alongside CVE-2026-77543, CVE-2026-77546, CVE-2026-77547, and CVE-2026-77548), which together affected a broad swath of the UniFi ecosystem — UniFi OS, UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, UID Enterprise Agent, and related hardware appliances.

Technical Details

How It Works

A malicious actor who already has network access to a UniFi Protect deployment — and holds only a low-privilege account — can supply crafted input that UniFi Protect fails to properly validate. Because the application passes this input through to an underlying system call without adequate sanitization, the attacker can inject arbitrary operating system commands that execute in the context of the host device.

Unlike the related CVE-2026-77537 disclosed in the same bulletin (a perfect CVSS 10.0 requiring no privileges at all), CVE-2026-77533 requires an attacker to already hold low-level access — but the bar remains low enough that any user with a foothold on the network, or a compromised low-privilege credential, can escalate to full command execution.

The issue was reported by Abdulaziz Almadhi of Catchify Security as part of Ubiquiti's coordinated disclosure process.

Impact Assessment

Who Is At Risk

• Organizations running UniFi Protect Application versions prior to 7.2.105
• Multi-tenant or shared-network environments where low-privilege accounts (guest VLANs, limited operator roles, integrator accounts) exist alongside Protect deployments
• Physical security operators relying on UniFi Protect for NVR/camera management, where command execution on the host could expose live video feeds, recordings, and connected device credentials

Potential Attack Chains

1. Low-Privilege Foothold — Attacker obtains or already holds a low-privilege account with network access to the Protect instance
2. Command Injection — Crafted input triggers unsanitized command execution on the host
3. Host Compromise — Attacker gains a shell in the context of the Protect service, exposing recorded footage, camera credentials, and network topology
4. Pivot — Compromised NVR/host hardware is used as a foothold to reach other segments of the UniFi ecosystem (Network, Access, Talk)

Mitigation

Immediate Actions

• Update UniFi Protect Application to version 7.2.105 or later — this is the vendor-confirmed fix
• Audit all accounts with access to Protect deployments and remove unnecessary low-privilege access
• Restrict network reachability to UniFi Protect management interfaces using VLAN segmentation or firewall rules
• Review Ubiquiti Security Advisory Bulletin 067 for the full list of affected components, since several other CVEs in the same disclosure may also apply to your deployment

Detection Opportunities

• Unexpected child processes spawned by the UniFi Protect service
• Anomalous outbound connections originating from NVR/Protect host devices
• Configuration or credential file access outside normal Protect operation patterns

Defence-in-Depth

• Run UniFi Protect hosts on isolated, purpose-built network segments separate from general user traffic
• Apply the principle of least privilege to all UniFi accounts, especially those with any network path to Protect
• Enable centralized logging for UniFi devices to a SIEM for anomaly detection

Background

UniFi Protect is widely deployed across small business, enterprise, and residential physical security installations. Given Ubiquiti's broad footprint and the fact that this disclosure bundles multiple critical command-injection and privilege-escalation flaws across the UniFi product line, administrators should treat Security Advisory Bulletin 067 as a fleet-wide patching priority rather than addressing CVE-2026-77533 in isolation.

References

• NVD — CVE-2026-77533
• Ubiquiti Security Advisory Bulletin 067
• cybersecuritynews.com — 21 Critical Ubiquiti UniFi Flaws