High [CVE-2026-116838] malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device
This high-severity Ubiquiti advisory covers CVE-2026-116838 affecting airMAX M.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Get an email when Ubiquiti publishes the next one.
VulniPulse checks Ubiquiti's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
- airMAX M before 6.3.26
Official advisory · high-confidence parse· fetched 4 days ago·verify at source
Mitigation
Upgrade to a fixed release: 6.3.26. That is the remediation for this advisory.
The vendor advisory may list interim mitigations or workarounds not captured here. Review it before change work.
Official advisory · high-confidence parse· fetched 4 days ago·verify at source
More Ubiquiti advisories
- CVE-2026-116839Oct 27, 2026malicious actor who lures an authenticated user to a malicious page could exploit
- CVE-2026-116837Oct 27, 2026malicious actor with access to the adjacent network could exploit a Heap-based Buffer
- CVE-2026-116836Oct 27, 2026malicious actor with access to the adjacent network and under certain conditions could
- CVE-2026-21639Jan 8, 2026airMAX AC: malicious actor in Wi-Fi range of the affected product
- CVE-2026-119251Oct 29, 2026malicious actor with local access and high privileges could exploit an Improper Access
- CVE-2026-119250Oct 29, 2026malicious actor with local access and low privileges could exploit an External Control
Android app · Google Play
Monitor future Ubiquiti CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.