CVE-2026-77545
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability f
CVSS
9.0
Critical
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 26, 2026 · Last modified: Aug 27, 2026 · CWE-489
Not enough EPSS history yet.
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-664058.8 HIG20.2%
——6DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.17dCVE-2026-664037.5 HIG16.7%
——5DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.17dCVE-2026-411867.5 HIG27.0%
——8When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.20dCVE-2026-65893—13.3%
——4This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware.
An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism.
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.31dCVE-2026-583788.8 HIG36.7%
——11Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.37dCVE-2026-547996.7 MED7.9%
——2A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.49d