Ubiquiti airMAX M: Cross-site request forgery enables configuration changes and DoS
Summary
Ubiquiti airMAX M outdoor wireless radios are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker who lures a logged-in administrator to a malicious web page can make unauthorized configuration changes and cause a denial of service on the device. The attack requires user interaction and an authenticated session, and there is no confidentiality impact.
Affected
- airMAX M firmware up to and including 6.3.24 (vendor advisory)
- Some sources state up to 6.3.25; treat all releases below 6.3.26 as affected
- Other airMAX lines in the same advisory (LTU PTMP, LTU PTP, SolarPoint/SolarSwitch) are not affected by this CVE
Fixed in
- Update airMAX M to firmware version 6.3.26 or later
Workaround
- The vendor advisory lists no workaround.
- If you cannot patch yet, restrict access to the device management interface to a trusted management VLAN.
- Do not browse untrusted websites while logged into device admin pages, and sign out after administration.
Exploitation
- CISA SSVC data: exploitation none, not automatable, partial technical impact.
- No public proof of concept found; this cannot be fully confirmed.
- EPSS: 0.1 %.
- Some third-party trackers report attack traffic or exposed hosts, but it is unclear which applies.
Our recommendation
- Update all airMAX M devices to version 6.3.26 or later at the next maintenance window.
- Patch the related CVE-2026-116838 and CVE-2026-116836 with the same update.
- Check whether the device management interface is reachable from the internet or user networks and restrict it.
- Prioritise WISP, rural link and flat-network deployments.
- Monitor for unusual configuration changes or device outages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubiquiti Security Advisory Bulletin 071 uisp.community.ui.com
- OpenCVE CVE-2026-116839 app.opencve.io
- VulDB CVE-2026-116839 vuldb.com
- OffSeq Radar CVE-2026-116839 radar.offseq.com
- Strix CVE-2026-116839 www.strix.ai
- PT-2026-125550 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 08:44.
Original description (NVD)
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.