CVE-2026-21639 describes a remote code execution (RCE) vulnerability in the airMAX Wireless Protocol affecting various Ubiquiti airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60 products. A malicious actor within Wi-Fi range can exploit this flaw to execute arbitrary code on the device. Rated as a medium severity (CVSS 5.4), this vulnerability has an adjacent attack vector with low attack complexity, requiring no user interaction or privileges, and could lead to partial confidentiality and integrity impacts. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. Organizations should update affected products to the recommended firmware versions to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 8.7.21CPE matchmatch criteria | cpe:2.3:o:ui:airmax_ac_firmware:*:*:*:*:*:*:*:* | ||
< 6.3.24CPE matchmatch criteria | cpe:2.3:o:ui:airmax_m_firmware:*:*:*:*:*:*:*:* | ||
< 1.2.3CPE matchmatch criteria | cpe:2.3:o:ui:airfiber_af60-xg_firmware:*:*:*:*:*:*:*:* | ||
< 2.6.8CPE matchmatch criteria | cpe:2.3:o:ui:airfiber_af60_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.