Ubiquiti UniFi Gateway Updates Fix Six Denial-of-Service Flaws
Tech GuruQuick Answer
Ubiquiti's six-CVE gateway notice addresses network-triggered denial of service. The fixed firmware depends on the device: 5.1.31 for the listed Dream/Cloud/Enterprise platforms and Express 7, 4.0.21 for Express, or 5.1.26 for UniFi Gateways. Match the exact model before selecting an update.
Confirm Scope And Apply The Supported Fix
What to do now: Record each gateway model and running firmware, back up its configuration, and schedule the matching update with recovery access available. Do not confuse Express with Express 7 or the device firmware with the Network application's version.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ubiquiti UniFi gateways and consoles |
|---|---|
| Advisory | Security Advisory Bulletin 069 |
| CVEs | CVE-2026-77544, CVE-2026-77555, CVE-2026-77556, CVE-2026-77558, CVE-2026-95861, CVE-2026-95862 |
| Earliest listed CVE record publication | 2026-09-22 18:34:39.993 UTC |
| Latest listed CVE record publication | 2026-09-22 18:49:39.376 UTC |
| Affected versions | Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, Dream Wall, and Express 7 before 5.1.31; Express before 4.0.21; UniFi Gateways before 5.1.26 |
| Fixed version | Applicable platform release 5.1.31, Express 4.0.21, or UniFi Gateway 5.1.26 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Ubiquiti's CNA identifies out-of-bounds writes for CVE-2026-77544, CVE-2026-77555 and CVE-2026-95862, out-of-bounds reads for CVE-2026-77556 and CVE-2026-77558, and uncontrolled recursion for CVE-2026-95861. The stated impact is device denial of service by an attacker with network access. The records do not establish arbitrary code execution or a particular exposed protocol.
What To Validate Now
- Inventory. Locate Ubiquiti UniFi gateways and consoles deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, Dream Wall, and Express 7 before 5.1.31; Express before 4.0.21; UniFi Gateways before 5.1.26 Do not infer applicability from product family or severity alone.
- Remediate. Use the supported firmware for the exact model: the table's 5.1.31, 4.0.21 or 5.1.26 boundary. Confirm upgrade prerequisites in Ubiquiti's device-specific release instructions; these branches are not interchangeable.
- Validate. Confirm the device's active firmware after the maintenance window, then check routing, client connectivity, configured VPNs and remote management. Retain recovery access until the gateway's normal functions are verified.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
