CVE-2026-77549criticalCWE-93

CVE-2026-77549: critical vulnerability in Ubiquiti Inc Cloud Gateways

Published · Updated

Follow this CVE+ Monitor Express+ Monitor UniFi OS Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 0.5%
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Ubiquiti Inc · Cloud GatewaysUbiquiti Inc · Cloud KeysUbiquiti Inc · Dream MachinesUbiquiti Inc · Dream RoutersUbiquiti Inc · Dream WallUbiquiti Inc · Enterprise Firewall CoreUbiquiti Inc · Enterprise Fortress GatewayUbiquiti Inc · Enterprise Network Attached StorageUbiquiti Inc · Enterprise Network Video RecordersUbiquiti Inc · ExpressUbiquiti Inc · Express 7Ubiquiti Inc · Network Attached StorageUbiquiti Inc · Network Video RecordersUbiquiti Inc · UniFi OS Server
Related CVEs — Ubiquiti Inc Cloud Gateways

In the same product, most dangerous first.

CVE-2026-54402CRITICALCVE-2026-54402EPSS 1.8%CVE-2026-77550CRITICALCVE-2026-77550EPSS 0.8%CVE-2026-54403HIGHCVE-2026-54403EPSS 0.8%CVE-2026-77558HIGHCVE-2026-77558EPSS 0.5%CVE-2026-77556HIGHCVE-2026-77556EPSS 0.5%CVE-2026-77544HIGHCVE-2026-77544EPSS 0.5%