HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-21639

CVSS 8.8v3.1pub. 2026-01-08upd. 2026-07-30

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ui Airfiber Af60

    HW
    Ui
    all versions

  • Ui Airfiber Af60 Firmware

    OS
    Ui
    < 2.6.8

  • Ui Airfiber Af60 Xg

    HW
    Ui
    all versions

  • Ui Airfiber Af60 Xg Firmware

    OS
    Ui
    < 1.2.3

  • Ui Airmax Ac

    HW
    Ui
    all versions

  • Ui Airmax Ac Firmware

    OS
    Ui
    < 8.7.21

  • Ui Airmax M

    HW
    Ui
    all versions

  • Ui Airmax M Firmware

    OS
    Ui
    < 6.3.24
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2015-9266CRITICAL9.8PL ✓same product

Ubiquiti airMAX/airFiber/EdgeSwitch XP — path traversal umożliwia zapis plików jako root

CVE-2017-0938HIGH7.5same product

Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Dis...

CVE-2022-44565MEDIUM5.3same product

An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG...

CVE-2026-34908CRITICAL10.0⚠ KEVPL ✓same vendor

Nieprawidłowa kontrola dostępu w UniFi OS — nieautoryzowane zmiany systemowe

CVE-2026-34909CRITICAL10.0⚠ KEVPL ✓same vendor

Path Traversal w UniFi OS — dostęp do plików systemowych i przejęcie konta