External risk intelligence

UniFi Access Application Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-77547

The UniFi Access Application is typically deployed within internal local networks to manage physical access control systems. While network-reachable within an environment, it is not traditionally exposed directly to the public internet, though it may be accessible via VPN or internal gateway configurations.

Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the UniFi Access Application allows a low-privilege attacker on the network to execute commands on the host device. This could potentially impact the integrity and availability of systems controlling physical access. The main concern is confirming relevance and exposure within our environment.

Unauthenticated attackers can gain control of systems.
Affects physical access controls, a key security layer.
Confirm if we use this specific access control software.

Attack Path

How an attacker could exploit the issue

An attacker on the network with limited privileges could exploit this vulnerability by sending specially crafted input to the UniFi Access Application. This could allow them to execute arbitrary commands on the device.

Network access with low privileges required.
Improper input validation is the trigger.
Command execution on the host device.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability exists in the UniFi Access Application that could allow an attacker with low network privileges to execute arbitrary commands on the host device. This Command Injection vulnerability, stemming from Improper Input Validation, could lead to a compromise of the affected system's integrity and confidentiality.

Host device commands could be executed.
Via network access and low privileges.
System compromise and unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Exploiting this Improper Input Validation vulnerability in the UniFi Access Application requires network access and low privileges, allowing a threat actor to execute Command Injection on the host device. Infrastructure or platform teams managing the UniFi application and the underlying host systems are likely responsible for remediation. The first practical step involves identifying all instances of the UniFi Access Application, confirming their network reachability and business criticality, and then assigning ownership to an accountable party for planning.

Infrastructure and Platform teams own remediation.
Verify network reachability and business criticality.
Plan remediation based on asset risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UniFi Access Application?

UniFi Access Application is a software component used to manage physical access control systems, such as electronic door locks and badge readers. It acts as the central hub for overseeing building security, managing user permissions, and monitoring entry activity within an organization.

What does the Improper Input Validation weakness mean for CVE-2026-77547?

This vulnerability, classified as CWE-20, means the software fails to properly filter or sanitize data provided by a user. Because of this flaw, an attacker can submit malicious data that the application incorrectly processes as a system command, leading to unauthorized command injection on the host device.

How does an attacker trigger this command injection?

An attacker must have existing network access and low-level user privileges to interact with the application. They trigger the bug by sending specially crafted input to the interface. Simply having network connectivity is insufficient; the attacker must be able to authenticate or communicate as a low-privileged user to successfully supply the malicious input.

Is my UniFi Access deployment at risk from the internet?

Halo Surface Signal notes that while the application is reachable within a local network, it is not typically designed to be exposed directly to the public internet. However, risk exists if the application is accessible via VPNs, remote gateways, or other configurations that bridge internal systems to broader network environments.

What is the first step to address this CVE?

Begin by auditing your infrastructure to locate every instance where the UniFi Access Application is running. Once identified, confirm the network reachability and business criticality of each system. This inventory allows security teams to assign ownership to the appropriate platform administrators for subsequent risk assessment and remediation planning.

References

community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.