External risk intelligence

UniFi Access Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-77546

The vulnerability affects an access control application which typically operates on local or internal management networks. While it requires network access, these systems are generally not designed to be directly exposed to the public internet, making internet-facing exploitation possible but not the common or intended deployment pattern.

Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in UniFi Access Application, which handles access control. An attacker with low privileges on the network could potentially take full control of affected systems, allowing for unauthorized command execution. The main concern at this time is confirming if our environment is affected by this technology.

Vulnerability allows network-based control takeover.
Protects critical access management systems.
Confirm exposure to UniFi Access Application.

Attack Path

How an attacker could exploit the issue

A user with low-level network access could trick the UniFi Access Application into running unintended commands. This happens because the application doesn't properly check the input it receives. Successfully triggering this flaw could allow an attacker to take significant control of the host device.

Requires network access and low privileges.
Exploits improper input validation.
Leads to command injection.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in UniFi Access Application could allow an attacker with network access and low privileges to execute arbitrary commands on the host device, potentially impacting its operation and security when supported by the advisory.

System commands and host device integrity.
Network-based input validation flaws.
Compromised system control and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

A malicious actor with network access and low privileges can exploit this vulnerability in the UniFi Access Application to execute commands on the host device. The first step is to identify all instances of the UniFi Access Application, determine their exposure to the network, and confirm if they are business-critical. Once accountable owners are identified, a risk-based remediation plan can be developed.

Identify accountable application owners.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UniFi Access Application?

The UniFi Access Application is a software component designed for UniFi hardware that manages physical door access, entry credentials, and security devices. It serves as the central control hub for building entry systems, coordinating communication between readers, locks, and administrators to secure facility perimeters.

How does CVE-2026-77546 allow command injection?

This vulnerability stems from Improper Input Validation (CWE-20). It occurs because the application fails to adequately sanitize data sent to it over the network. If a user provides malicious input, the application may inadvertently process that data as a system command, allowing it to run on the underlying host device rather than just handling it as intended information.

Do I need elevated network privileges to trigger this?

No, only low-level network access is required to attempt an exploit. However, the flaw is triggered specifically by sending crafted input to the application. Simply having network connectivity is not enough; the attacker must be able to interact with the service in a way that provides unvalidated data, which the application then mistakenly executes.

Is my system at risk if it is not on the internet?

Halo Surface Signal notes that while internet-facing exploitation is possible, these systems are typically housed on internal management networks. Because the vulnerability requires network access, an isolated system is harder to reach, but internal users or compromised devices on the same network could still potentially reach the application.

How should I respond to this vulnerability?

Start by auditing your infrastructure to locate all instances of the UniFi Access Application. Once located, verify their network placement and determine their criticality to your operations. Coordinate with the accountable system owners to evaluate the risk and prioritize a remediation plan, which may include applying vendor-provided updates once they become available.

References

community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.