A 9.9 Severity Bug Dropped in My Router's Software. Here's What I Did.

I run a UniFi Dream Wall at home. On September 1, Ubiquiti published CVE-2026-77547 against the UniFi Access Application. CVSS 9.9 out of 10.

That number gets thrown around a lot, so here is what it actually means in this case: someone who already has low-privilege access to your network can run arbitrary commands on the device. Not "might be able to under lab conditions." Run commands.

Are you affected?

Only if you have the Access Application installed. This is the door-and-entry product, not the base UniFi Network stack. Plenty of people running a Dream Machine or Dream Wall never installed it.

To check:

1. Open your UniFi console
2. Look at your installed applications
3. If Access is not in the list, you are done

If you do have it

Apply the pending update. That is the whole fix. Ubiquiti shipped the patch with the advisory.

While you are in there, one thing worth doing regardless of this CVE: restrict your management interface to an admin VLAN. If your console is reachable from the same network as your TV, your doorbell, and your kid's tablet, then "low-privilege network attacker" describes a much larger group of devices than you want it to.

Why I caught this before the headlines

I run a weekly vulnerability scan against the specific gear I own. Not a generic feed, a list built from my actual hardware and software. UniFi, Ollama, macOS, the Node packages my projects depend on.

That is the part most people skip. Security news is firehose-shaped, and almost none of it applies to you. Filtering it down to your own stack turns 200 headlines a week into one or two things you actually have to act on.

This week it was one. Last week it was three, including a set of CVSS 10.0 issues in the same UniFi ecosystem.

The wider point

The median time from a vulnerability being disclosed to it showing up on CISA's exploited list dropped from 8.5 days to 5 days. The window between "this is public" and "this is being used" is closing.

You do not need an enterprise security program to keep up. You need a list of what you own and a habit of checking it.

Start with the list.