Ubiquiti Bulletin 067: patch UniFi OS, Protect, Access, and Talk now

Ubiquiti published Security Advisory Bulletin 067 on August 26, 2026. It covers 22 CVEs across the UniFi ecosystem: 21 rated Critical and one rated High. The headline numbers are ugly, but the useful response is not panic. It is an accurate inventory followed by a controlled update window.

Several flaws can lead to command injection, privilege escalation, or authentication bypass. Some require an existing low- or high-privilege account. Others require no privileges but still require network access to the affected service. That distinction matters when deciding patch order, but it is not a reason to wait a month.

The versions you need to reach

The table below condenses Ubiquiti’s advisory into deployment targets. “Affected through” is inclusive.

Product or platform	Affected through	Update to
UniFi Protect Application	7.1.87	7.2.105 or later
UniFi OS Server	5.1.21	5.1.37 or later
Cloud Keys, Network Video Recorders, Enterprise NVRs, Enterprise NAS, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7	5.1.26	5.1.31 or later
Network Attached Storage	5.1.26	5.1.32 or later
Express	4.0.16	4.0.17 or later
UniFi Network Application	10.4.57	10.5.67 or later
UniFi Access Application	4.3.3	4.3.5 or later
UniFi Talk Application	5.2.7	5.3.2 or later
UniFi Connect Application	3.24.20	3.24.22 or later
UID Enterprise Agent	1.61.8	1.62.1 or later
UniFi Connect Display Cast Pro	1.0.108	1.0.111 or later
UniFi Enterprise Audio/Video Bridge	1.0.10	1.0.11 or later
UniFi Protect AI Key	2.1.3	2.2.6 or later

Ubiquiti says the updates are rolling out in stages, so a fixed release may not appear in every console immediately. That means “I clicked Check for Updates” is not a completed patch ticket. Record the installed version and compare it with the target above.

What the 22 vulnerabilities can do

The most concerning group is on UniFi Protect. CVE-2026-77533, CVE-2026-77537, and CVE-2026-77548 are command-injection flaws. Two require low privileges; CVE-2026-77537 is scored 10.0 with no privileges or user interaction required. If Protect runs your cameras, the affected application also lives on a device you probably expect to be dependable during an incident.

The UniFi OS group includes CVE-2026-77534, CVE-2026-77536, CVE-2026-77545, CVE-2026-77549, and CVE-2026-77550 across the appliance families in the table. The impacts include privilege escalation and authentication bypass. CVE-2026-77550 is the 10.0 flaw: Ubiquiti describes a network-reachable CRLF-neutralization issue that can bypass authentication. UniFi OS Server also has two high-privilege command-injection flaws, CVE-2026-77539 and CVE-2026-77540.

UniFi Network 10.4.57 and earlier has CVE-2026-77535 and CVE-2026-77541. Both require high privileges and are scored 9.1. One can inject commands into an adopted device; the other can escalate privileges inside the Network application. High privileges are a precondition, not a free pass: stolen administrator sessions and over-broad MSP accounts are exactly why privileged paths still deserve patches.

UniFi Access accounts for four 9.9 flaws: CVE-2026-77543, CVE-2026-77546, CVE-2026-77547, and CVE-2026-77553. They require low privileges and can lead to command injection or host privilege escalation. Treat this update carefully because Access is connected to physical entry workflows, but do not confuse operational caution with permission to defer indefinitely.

The remaining advisory entries cover command injection in UID Enterprise Agent (CVE-2026-77542), Enterprise Audio/Video Bridge (CVE-2026-77552), and UniFi Talk (CVE-2026-77554); privilege escalation in Connect (CVE-2026-77538), Display Cast Pro (CVE-2026-77551), and Protect AI Key (CVE-2026-77557). Ubiquiti notes that the Connect flaw can be chained with dependency vulnerabilities to escalate privileges on the host.

“Network access” does not automatically mean internet exploitation

Ubiquiti repeatedly describes an attacker “with access to the network.” The CVSS vectors are network-based, but that does not prove every vulnerable console is reachable from the public internet. Exposure depends on where management services are listening, firewall rules, remote-access configuration, and whether an attacker is already on a trusted, guest, camera, or IoT segment.

As of this writing, Ubiquiti’s advisory does not claim active exploitation, and none of these 22 CVEs appears in CISA’s Known Exploited Vulnerabilities Catalog. That is a snapshot, not proof that exploitation has never happened. Patch based on consequence and exposure; do not wait for a breach headline to make the ticket urgent.

A practical patch and verification checklist

1. Inventory every UniFi site and application. Capture the console model, UniFi OS version, and installed Network, Protect, Access, Talk, Connect, and UID application versions. Do not forget self-hosted UniFi OS Server or a standalone AI Key in another dashboard.
2. Check management exposure. Remove direct WAN access to administration interfaces. Restrict management to a trusted admin path and make sure guest, camera, voice, and IoT networks cannot reach the console unnecessarily. If your segmentation is undocumented, start with a one-page network diagram.
3. Take a current configuration backup. Confirm where it landed and that the file is readable before changing a gateway, Cloud Key, NVR, or access-control console.
4. Use a maintenance window with an owner. Update a representative low-impact site first when your fleet allows it. For door access, phones, cameras, and routing, have a rollback or onsite-access plan instead of clicking Update five minutes before closing time.
5. Reach every applicable fixed version. Updating UniFi OS does not prove a separately listed application is current. Work through the table product by product.
6. Test the service, not just the version label. Confirm gateways pass traffic, APs and switches remain adopted, cameras record and play back, doors operate, phones place calls, and remote administration still works.
7. Record the change and recheck. Document previous and new versions, time, operator, validation results, and exceptions. Our one-page firewall change format works for this kind of maintenance too.

If logs show unknown administrators, unexplained configuration changes, suspicious command activity, or access from an unexpected network, stop treating this as routine patching. Preserve evidence, revoke suspicious sessions, rotate affected credentials, and move into incident response.

Bottom line: Bulletin 067 is a broad, high-consequence UniFi update, not evidence that every Ubiquiti site has already been compromised. Inventory first, remove unnecessary management exposure, patch every applicable platform and application to Ubiquiti’s fixed versions, and verify the actual business service afterward. A green Update button is not the same thing as a tested network.