CVE-2026-116836: XSS

Published Oct 27, 2026

Updated

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.

Affected Software

1 affected component

Ubiquiti airMAX M

Event History

Oct 27, 2026

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to exploitation?

Exposure is limited to Ubiquiti airMAX M devices reachable by an attacker on an adjacent network. The provided information does not identify the additional conditions required for exploitation.

Does an attacker need an account or direct user interaction to exploit this issue?

The vulnerability is rated as requiring no privileges, but it does require user interaction. The provided data does not specify what interaction is needed or which user must perform it.

What could successful exploitation allow?

Successful exploitation could enable privilege escalation on the affected device. The severity metrics indicate potential high impact to confidentiality, integrity, and availability, including impacts beyond the vulnerable security authority.

CVE-2026-116836: XSS

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to exploitation?

Does an attacker need an account or direct user interaction to exploit this issue?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to exploitation?

Does an attacker need an account or direct user interaction to exploit this issue?

What could successful exploitation allow?