Ubiquiti just shipped three perfect-10 security bugs in one bulletin — and one needs zero password

Ubiquiti published Security Advisory Bulletin 067 on August 26, and it's the ugliest one the company has shipped all year. Twenty-two vulnerabilities across the UniFi product line, 21 of them critical, and three sitting at a perfect CVSS 10.0 — meaning an attacker needs no password, no user interaction, and barely any skill to walk in the front door. This isn't one bad patch in one app. It's three separate maximum-severity bugs, in three separate products, disclosed on the same day.

Three perfect scores, three different products

What makes this bulletin worse than a normal critical-patch Tuesday is the spread. UniFi Protect is the camera and doorbell platform — the thing storing your actual security footage. UniFi Talk is a VoIP phone system bolted onto the same ecosystem. And UniFi OS is the console underneath both of them, the layer that boots the Dream Machine or Cloud Gateway you plugged in and forgot about. A bug in one app is a bad week. A perfect-10 in the OS layer means everything sitting on top of it inherits the exposure.

The one I'd lose sleep over: CVE-2026-77550

My honest take: the Protect and Talk bugs are bad, but CVE-2026-77550 is the one that actually scares me, because it isn't scoped to one app you could just disable. CRLF injection against UniFi OS means an attacker can smuggle extra headers or commands into requests the console trusts, and use that to skip the login screen for the entire management layer — the same console that holds your network topology, your camera feeds, your VoIP call logs, and every other UniFi service you've bolted on. Compromise the OS and you don't need to separately break Protect or Talk. You already own the box they're running on.

A pattern, not a one-off

Ubiquiti's disclosure cadence this year reads like a slow-motion warning: a single CVSS 10.0 in March, another in May, another in July, and now three at once in August. Ubiquiti is far from alone here — 2026 has been a brutal year for perfect-10 bugs in network-facing appliances generally, from Cisco's own Crosswork platform shipping five CVSS 10.0 bugs it found itself to N-able's N-central RMM tool getting hit by an actively-exploited auth bypass to VMware vCenter's reverse-SSH zero-day hitting 47 countries. The common thread isn't sloppiness at any one vendor — it's that management consoles and appliance OSes have become the preferred target, because compromising one gets an attacker everything running underneath it, in one move.

Ubiquiti's advisory shipped without much commentary beyond the fix list, which is standard for the company and not itself a red flag. But the track record on UniFi-specific CVEs this year says the gap between disclosure and active scanning has been shrinking, not growing. If you're running UniFi gear at home and haven't opened the console in a few months, this is the week to do it — not because there's proof anyone's exploiting these three yet, but because by the time there is, you want to already be patched.