Ubiquiti airMAX M: Cross-Site Request Forgery leading to command injection
Summary
Ubiquiti airMAX M devices are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker who lures a logged-in administrator to a malicious web page can make the device execute a command injection. The attack needs no network position, but an authenticated user must visit the malicious page. The CNA rates the issue with CVSS 8.8, while VulDB gives 4.3.
Affected
- airMAX M versions 0 to below 6.3.26 according to the CNA record (CVE Program)
- VulDB lists versions up to 6.3.25; the exact range in the vendor bulletin could not be fully verified
Fixed in
- Version 6.3.26 or later according to OffSeq and VulDB
- Check the vendor bulletin for the exact fixed release before relying on this
Workaround
- No vendor workaround confirmed.
- Until the update is done, limit web interface access to known IP addresses or a VPN.
- Restrict admin browsing sessions. This is an unverified third-party suggestion.
Exploitation
- Not known to be exploited according to OffSeq.
- Not listed in CISA KEV according to Strix.
- No public proof of concept found.
- VulDB labels the entry as 0-Day, which is probably a disclosure-timing label and does not confirm exploitation.
Our recommendation
- Inventory all airMAX M devices and their firmware versions.
- Check the vendor bulletin and update to 6.3.26 or later.
- Restrict management access to trusted networks or a VPN.
- Do not use the admin workstation for general web browsing.
- Prioritise internet-exposed devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubiquiti Security Advisory Bulletin 071 uisp.community.ui.com
- VulDB CVE-2026-116838 vuldb.com
- VulDB vulnerability 427036 vuldb.com
- OffSeq Radar CVE-2026-116838 radar.offseq.com
- Strix CVE-2026-116838 www.strix.ai
- threatint CVE-2026-116838 cve.threatint.com
- OpenCVE CVE-2026-116838 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:17.
Original description (NVD)
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.