Ubiquiti Patches 3 Maximum Severity UniFi Flaws In Protect, UniFi OS And Talk, With Around 3200 Australian Consoles Exposed.
Ubiquiti Patches 3 Maximum Severity UniFi Flaws – Ubiquiti’s Security Advisory Bulletin 067, released on August 26, fixes 22 critical vulnerabilities across the UniFi range. 3 of them are rated CVSS 10.0, in UniFi Protect, UniFi OS Server and UniFi Talk, and all 3 can be exploited without authentication or any user interaction.
If you install or maintain UniFi Protect video or UniFi Access doors, this one matters. Internet scanning firm Censys counted around 3200 Australian UniFi OS management interfaces exposed to the internet the day after disclosure – and the last time Ubiquiti published a bulletin like this, attackers didn’t take long to act on it.
UBIQUITI has become a serious force in the SMB security market over the past few years. Protect cameras and NVRs, Access readers and hubs, and Talk VoIP now run on the same consoles as the network itself. That convergence is a big part of the appeal for installers and end users alike. It also means that when the platform has a bad day, cameras, doors and phones have a bad day together.
The 3 maximum severity flaws are:
- a command injection vulnerability in UniFi Protect (CVE-2026-77537)
- a CRLF injection in UniFi OS Server that leads to authentication bypass (CVE-2026-77550)
- a vulnerability in UniFi Talk (CVE-2026-77554)
All 3 sit at the top of the CVSS scale, and all 3 can be exploited remotely by an attacker with no credentials and no help from a user.
Importantly for access control installers, UniFi Access is in the bulletin as well. It has 4 vulnerabilities (CVE-2026-77543, CVE-2026-77546, CVE-2026-77547 and CVE-2026-77553), all fixed in Access 4.3.5. Protect AI Key and UniFi Network also receive fixes.
The fixed versions are:
- UniFi Protect 7.2.105 or later
- UniFi OS Server 5.1.37 or later
- UniFi Talk 5.3.2 or later
- UniFi Access 4.3.5
- Protect AI Key 2.2.6
- UniFi Network 10.5.67
How Exposed Is Australia?
Censys scanned for affected systems on August 27, the day after disclosure. It found more than 100,000 UniFi OS management interfaces exposed to the internet worldwide, along with 828 UniFi Protect hosts. Around 3200 of those UniFi OS hosts were in Australia – roughly 3.1 per cent of the global total.
That’s not a small number for a market our size. Given how many UniFi consoles run cameras and doors alongside the network, you’d have to assume a fair portion of those 3200 boxes are doing security work.
At disclosure, no in-the-wild exploitation of the SAB-067 flaws had been confirmed. Having said this, recent history isn’t encouraging. The flaws in Ubiquiti’s earlier SAB-064 bulletin went from patch to botnet exploitation in around 33 days. And in June, CISA ordered the patching of 3 earlier UniFi OS flaws that attackers were exploiting to deliver a Mirai botnet loader.
We’re now well past 33 days since SAB-067 dropped. If there are UniFi consoles on your customer list that nobody has touched since August, that’s a problem worth solving this week.
What Should Installers Do?
The first job is simple: check every UniFi console you’re responsible for against the fixed versions above and update anything that’s behind. Don’t assume auto-update has done the job – log in and look.
The second job is the one that actually reduces risk. A UniFi OS management interface has no business sitting on the open internet. We’d pull port forwards and use Ubiquiti’s own remote management or a VPN instead. If a console has been exposed for weeks without patches, it’s also worth a squiz through its admin accounts and logs for anything you don’t recognise.
There’s a hardening option on the network side as well. UniFi Network 10.6, released on August 25, introduces PoE port locking. It’s the first phase of port security for UniFi PoE device connections, it’s coming to Early Access, and it needs switch firmware 7.6 or later. For camera installs, the appeal is obvious – it makes it harder for someone to unplug a camera and drop their own device onto that port.
SEN’s View
In fairness to Ubiquiti, every vendor ships vulnerabilities. What counts is how quickly fixes and details reach the people who need them, and Ubiquiti published both together.
In our opinion, the bigger issue is the management model on smaller jobs. A console goes in, the cameras get tuned, the customer is happy – and nobody owns the patching after that. When a single box runs the network, the video and the doors, that gap stops being a minor IT matter and becomes a security matter.
October is Cyber Security Awareness Month, and that makes it a good moment for installers to put UniFi patching into maintenance agreements in writing. Customers will thank you for it, even if they never notice.
You can read Ubiquiti’s Security Advisory Bulletin 067 here, see Censys’ exposure analysis here or read more SEN news here.
FEATURES: UniFi SAB-067 At A Glance
- 22 critical vulnerabilities across the UniFi range
- 3 rated CVSS 10.0: Protect, UniFi OS Server and Talk
- UniFi Access fixed in version 4.3.5
- Around 3200 exposed Australian UniFi OS hosts (Censys, August 27)
- Fix: update consoles and remove management interfaces from the internet.
