Update Your Ubiquiti UniFi Gear Now: 22 Security Flaws Include Three CVSS 10 Bugs

What does Ubiquiti Security Advisory Bulletin 067 fix?

Ubiquiti Security Advisory Bulletin 067 fixes 22 vulnerabilities across the UniFi ecosystem, including flaws affecting UniFi OS, UniFi Protect, UniFi Network, and UniFi Talk. Ubiquiti published the advisory on August 26, 2026, and the bulletin identifies affected software branches and corrected releases for supported products. Ubiquiti’s Security Advisory Bulletin 067 provides the vendor’s release guidance.

Ubiquiti UniFi deployments often combine a gateway, controller, camera recorder, and communication service under the same management environment. That product overlap matters because a household or small business may need more than one update, even when the network gateway already shows a current UniFi OS version. The practical response is to check every UniFi application installed on the console rather than treating one firmware update as a complete fix.

Ubiquiti’s advisory is especially relevant for owners who use UniFi gear as an always-on network controller or remote management endpoint. A device that manages network access, camera recordings, or phone services can have a larger security role than a typical standalone router. Owners should identify their controller model and installed applications before beginning the update process.

Which UniFi vulnerabilities have the highest severity?

Three Bulletin 067 vulnerabilities have the maximum CVSS v3.1 score of 10.0: CVE-2026-77537 in UniFi Protect, CVE-2026-77550 in UniFi OS, and CVE-2026-77554 in UniFi Talk. NHS England states that 21 of the 22 disclosed vulnerabilities have scores of 9.0 or higher, which places nearly the full advisory in the highest severity range. NHS England’s cyber alert also notes that some flaws require neither authentication nor user interaction.

CVE-2026-77550 can allow a network-reachable attacker to bypass authentication on affected UniFi OS devices. CVE-2026-77537 and CVE-2026-77554 can permit command injection on the devices hosting UniFi Protect and UniFi Talk. These findings matter because authentication and command execution are central security controls for a management appliance.

Ubiquiti UniFi owners should not assume that a device is safe because remote access is normally protected by a password. The disclosed authentication-bypass issue concerns affected software itself, while command-injection flaws concern how affected services handle malicious input. The most sensible approach is to apply the relevant fixed release before relying on account credentials or network segmentation as the main protection.

Which Ubiquiti UniFi devices and software versions are affected?

Ubiquiti UniFi hardware affected by Bulletin 067 includes Cloud Keys, Dream Machines, Dream Routers, Cloud Gateways, Network Video Recorders, Enterprise NVRs, UniFi NAS devices, Dream Wall, Enterprise Fortress Gateway, and UniFi Express models. The affected product list covers consumer, prosumer, and business deployments, so the advisory is not limited to a single gateway or controller line.

Vulnerable ranges include UniFi OS Server 5.1.21 and earlier, most UniFi OS appliances on 5.1.26 and earlier, UniFi Protect 7.1.87 and earlier, UniFi Network 10.4.57 and earlier, and UniFi Talk 5.2.7 and earlier. Censys’ affected-version analysis lists the vulnerable branches and the corrected targets.

Ubiquiti UniFi software versions need to be checked separately because a console can run UniFi OS alongside multiple applications. A Dream Machine, for example, may need a UniFi OS firmware update and a separate UniFi Network or Protect application update. Owners should compare every installed version against the specific release target for their device instead of using the oldest affected version as the only decision point.

How do you update UniFi gear safely?

Ubiquiti UniFi owners should back up available configuration and recording information before installing Bulletin 067 updates, then apply the fixed version identified for each device and application. A security update is necessary here, but a gateway, controller, or recorder restart can interrupt network access and related services while the installation completes.

1. Identify every UniFi console and application in use, including UniFi OS, Network, Protect, and Talk.
2. Record the installed version shown by each console or application.
3. Back up configuration data and confirm that you can access the local network if remote management becomes unavailable.
4. Install the device-specific fixed release listed for the affected UniFi product.
5. Verify the installed version after the update and confirm that normal network, camera, or phone functions return.

Ubiquiti UniFi updates require a device-specific release target because the corrected versions differ by software component. Fixed releases cited in the affected-version analysis include UniFi OS Server 5.1.37, UniFi OS appliance firmware 5.1.31, UniFi Protect 7.2.105, UniFi Network 10.5.67, and UniFi Talk 5.3.2. Do not interrupt an update or attempt unsupported recovery steps if a console fails to restart normally.

Ubiquiti UniFi owners should stop and contact Ubiquiti support or their managed service provider if the update fails partway, the device becomes inaccessible, or a recovery process requires firmware-level intervention. Security patching is important, but an incomplete firmware process can leave a network appliance unavailable. The same cautious update approach applies to other actively relevant security fixes, including a recent iPhone security patch that addressed spyware-related risk.

Why does internet exposure make the UniFi update more urgent?

Internet-exposed UniFi management interfaces increase the urgency of Bulletin 067 because the authentication-bypass issue is described as network-reachable. Censys counted 102,607 internet-exposed UniFi OS management interfaces and 52,053 exposed UniFi Network Application interfaces on August 27, 2026. Those populations overlap, so the figures cannot be added to estimate a total number of unique devices.

Internet exposure does not prove that a UniFi device is vulnerable or unpatched. A reachable interface can run a fixed release, and an affected device may not be reachable from the public internet. Even so, the scale of exposed management services gives owners a practical reason to review remote-access settings promptly, especially when the advisory includes flaws that can work without authentication or user interaction.

Ubiquiti UniFi owners should limit direct internet access to management interfaces after completing the update. The goal is to reduce the number of systems that can reach the administrative service while preserving the remote access method a household or organization actually needs. Security agencies have issued similar warnings when vulnerabilities affect internet-exposed services, where public reachability can increase the consequences of a missed patch.

What should UniFi owners check after installing the update?

Ubiquiti UniFi owners should confirm the installed version, review management exposure, and check normal service behavior after applying Bulletin 067. The version check confirms that the device reached the fixed software target, while the operational check confirms that routing, wireless access, camera recording, and calling functions work as expected for the products in use.

Ubiquiti UniFi administrators should review three areas after patching: remote management access, accounts with administrative privileges, and unexpected configuration changes. These checks do not replace the update, but they help identify whether the management environment is exposed more broadly than intended. The advisory’s severity makes it sensible to treat a public-facing management console as a priority system.

• Check whether the UniFi OS, Network, Protect, or Talk version matches the applicable corrected release.
• Review whether a management interface is reachable from the public internet.
• Confirm that only necessary administrator accounts retain access.
• Verify that the gateway, wireless network, cameras, recorders, and phone services operate normally.

Ubiquiti UniFi owners should also keep an eye on account and service data that could be affected if a management system is compromised. The consequences of an incident vary by deployment, but security events can expose information beyond the device itself, as shown by the effects of a reported data breach. The practical action is to document unexpected behavior and seek vendor support if administrative settings change without an authorized explanation.

Is there evidence that Bulletin 067 flaws are being exploited?

Bulletin 067 vulnerabilities had no reported evidence of active exploitation or public proof-of-concept code as of Censys’ August 28, 2026 publication. That status is useful context, but it does not reduce the need to patch because the advisory includes 22 vulnerabilities and three flaws with CVSS 10.0 scores.

Ubiquiti UniFi owners should interpret the absence of known exploitation as a limited snapshot, not as a reason to delay. Public vulnerability disclosures identify affected components and fixed versions, which gives defenders a clear remediation path. The safer response is to update while no active exploitation evidence has been reported, then reduce unnecessary public exposure of management interfaces.

Ubiquiti UniFi administrators should prioritize systems that are reachable from the internet or that manage security cameras, network access, or communication services. A local-only system still needs the relevant update because affected software remains affected software. Owners who cannot patch immediately should identify the device-specific fixed target and arrange a maintenance window as soon as possible.

FAQ

Do all Ubiquiti UniFi owners need to update?

Ubiquiti UniFi owners should check for Bulletin 067 updates if they use affected UniFi OS, Protect, Network, or Talk software. The advisory covers 22 vulnerabilities across multiple controllers, gateways, recorders, and related products.

Which UniFi flaw allows authentication bypass?

CVE-2026-77550 can allow authentication bypass on affected UniFi OS devices when an attacker can reach the device over a network. Ubiquiti UniFi owners should install the applicable fixed UniFi OS release rather than relying only on passwords.

What are the fixed versions for the UniFi security update?

Fixed releases include UniFi OS Server 5.1.37, UniFi OS appliance firmware 5.1.31, UniFi Protect 7.2.105, UniFi Network 10.5.67, and UniFi Talk 5.3.2. Ubiquiti UniFi owners should verify the correct target for their specific hardware and software combination.

Are UniFi vulnerabilities being actively exploited?

Bulletin 067 vulnerabilities had no reported evidence of active exploitation or public proof-of-concept code as of August 28, 2026. Ubiquiti UniFi owners should still patch promptly because the disclosed flaws include three CVSS 10.0 issues.

Should UniFi management interfaces be exposed to the internet?

Ubiquiti UniFi management interfaces should not be directly exposed to the internet unless remote access is necessary and carefully managed. Censys identified more than 154,000 exposed UniFi management interfaces across two overlapping populations, making exposure review an important part of remediation.