UniFi OS Patch Guide

Ubiquiti’s Security Advisory Bulletin 067, published August 26, 2026, addresses 22 vulnerabilities across UniFi OS and applications. Check both the appliance operating system and every installed UniFi application: the minimum releases include Protect 7.2.105, Talk 5.3.2 and UniFi OS Server 5.1.37. Most listed consoles need UniFi OS 5.1.31; Network Attached Storage and the original Express use different minimums. [4]

Updating closes the addressed vulnerabilities; it does not establish whether an exposed system was used before the update. Record the installed versions and management exposure, install the applicable supported release, and investigate unexpected accounts or configuration changes. Ubiquiti’s August bulletin does not state that its flaws are being exploited. The older May flaws have a separate confirmed-exploitation history, explained below.

Bulletin 067: which component needs an update?

These are the advisory’s minimum fixed versions, checked September 8. Use a later supported release offered for the exact model when available; do not downgrade a newer installation to these numbers. Not every listed product is affected by every CVE. [4]

• Protect Application: 7.1.87 and earlier → 7.2.105 or later. Talk Application: 5.2.7 and earlier → 5.3.2 or later.
• UniFi OS Server: 5.1.21 and earlier → 5.1.37 or later.
• Cloud Keys, NVRs, Enterprise NVRs, Enterprise NAS, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall and Express 7: 5.1.26 and earlier → 5.1.31 or later.
• Network Attached Storage: 5.1.26 and earlier → 5.1.32 or later. Keep this separate from Enterprise NAS.
• Original Express: 4.0.16 and earlier → 4.0.17 or later. This is a different release line from Express 7.
• Other affected applications and devices: Network 10.5.67, Connect 3.24.22, Access 4.3.5, UID Enterprise Agent 1.62.1, Connect Display Cast Pro 1.0.111, Enterprise Audio/Video Bridge 1.0.11 and Protect AI Key 2.2.6 are the respective minimum fixed releases. Check the component-specific affected ranges in the bulletin.

Three maximum-severity flaws, different targets

• CVE-2026-77537: unauthenticated command injection in Protect Application.
• CVE-2026-77550: authentication bypass in the listed UniFi OS products, including the original Express.
• CVE-2026-77554: unauthenticated command injection in Talk Application.

Ubiquiti rates all three CVSS 10.0 and describes network access as a prerequisite. An attacker reaching a vulnerable service may be on an internal network or a reachable remote path; the rating does not mean every device is publicly exposed. The other bulletin entries have their own privilege, interaction and product conditions. [4]

What to do now

1. Inventory every UniFi OS device. Check Cloud Gateways, Dream Machines, Cloud Keys, NVRs, NAS appliances, Express devices, and any separate UniFi OS Server. Do not rely only on the main controller view.
2. Install the fixed UniFi OS release. Back up the configuration and record the installed OS/application versions. Follow the supported upgrade path for the exact model, apply the Bulletin 067 releases above, and confirm the running versions after restart. Updating only the Network Application does not update Protect, Talk or UniFi OS. [4]
3. Restrict management access. The admin interface should not be broadly reachable from the internet. Prefer VPN, a management VLAN, or a small trusted source range.
4. Review accounts and configuration changes. If management was exposed or you see suspicious activity, preserve available logs and compare against a known-good configuration. Look for unknown admins, new API tokens, remote-access changes, unfamiliar camera viewers, changed Talk settings, unexpected VPN or port-forwarding rules, altered firewall policies and unfamiliar backups. Revoke unauthorized access from a trusted device and investigate before restoring a backup that may contain the same changes.
5. Check client systems if compromise indicators exist. If a network incident also involved suspicious downloads, unknown scripts, or odd outbound connections from Windows PCs, scan endpoints with Gridinsoft Anti-Malware and verify suspicious domains or files with Gridinsoft Online Virus Scanner.

The useful distinction is between patching the appliance and trusting the network again. A patched UniFi device closes the known bugs, but a quick configuration review helps catch changes that may have been made before the update. Related Gridinsoft background on network-device risk includes our older Ubiquiti G4 vulnerability note and broader coverage of IoT cyber attacks.

Earlier Bulletin 064: May patches and June exploitation notice

The May bulletin covered five flaws: CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000 and CVE-2026-34911. On June 23, CISA added the first three to its Known Exploited Vulnerabilities catalog. This finding concerns the older flaws, not proof of exploitation of Bulletin 067. [5]

The following May thresholds are retained to identify older installations and historical remediation records. They are not the current update targets; use the Bulletin 067 minimums above. [1] The original Server and Cloud Gateway release notes are retained below. [2] [3]

• Product group: UniFi OS Server Vulnerable version threshold: 5.0.6 and earlier Fixed version to install: 5.0.8 or later
• Product group: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber Vulnerable version threshold: 5.0.16 and earlier Fixed version to install: 5.1.12 or later
• Product group: UDR-5G, ENVR-Core, UCKP, UCK, UCK-Enterprise Vulnerable version threshold: 5.0.17 and earlier Fixed version to install: 5.1.12 or later
• Product group: UNVR-G2 and UNVR-G2-Pro Vulnerable version threshold: 5.1.11 and earlier Fixed version to install: 5.1.12 or later
• Product group: UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8 Vulnerable version threshold: 5.1.8 and earlier Fixed version to install: 5.1.10 or later
• Product group: Express Vulnerable version threshold: 4.0.13 and earlier Fixed version to install: 4.0.14 or later

What those earlier CVEs mean

The highest-priority entries are CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. Ubiquiti describes them as network-reachable issues that do not require prior authentication and carry full confidentiality, integrity, and availability impact. In plain terms, a vulnerable management plane can become a route to system changes or sensitive files if an attacker can reach it.

CVE-2026-33000 is narrower because it requires high privileges and applies to UniFi OS Server, but it can still lead to command injection. CVE-2026-34911 has a lower score, yet it can expose sensitive information to a low-privileged network attacker. The response should be patch-first, then check whether the device configuration still matches what you expect.

FAQ

References

1. Ubiquiti Community, Security Advisory Bulletin 064, published May 21 and updated May 22, 2026, accessed September 8, 2026. Advisory
2. Ubiquiti Community, UniFi OS Server 5.0.8 release notes, accessed September 8, 2026. Release notes
3. Ubiquiti Community, UniFi OS Cloud Gateways 5.1.12 release notes, accessed September 8, 2026. Release notes
4. Ubiquiti. “Security Advisory Bulletin 067.” Ubiquiti Community, August 26, 2026, accessed September 8, 2026. Current advisory.
5. CISA. “Known Exploited Vulnerabilities Catalog.” Entries CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910 added June 23, 2026; accessed September 8, 2026. Official catalog data (JSON).