CVE-2026-77539
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS
CVSS
9.1
Crítico
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 26 ago 2026 · Última mod.: 27 ago 2026 · CWE-20
Sin historial EPSS suficiente todavía.
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-565473.5 BAJ—
———The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.23hCVE-2026-775409.1 CRÍ—
———A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.15hCVE-2026-182615.7 MED3.5%
——1Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.23hCVE-2026-182605.7 MED3.5%
——1Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.2hCVE-2026-166435.7 MED3.5%
——1Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.23hCVE-2026-166425.7 MED3.5%
——1Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.23h