CVE-2026-116838: CSRF
Published Oct 27, 2026
·Updated
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
Affected Software
1 affected component
Ubiquiti airMAX M
Event History
Oct 27, 2026
CVE Published
via MITRE·12:48 AM
Data Sourced
via MITRE·12:48 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions are required to exploit this issue?
An attacker must lure an authenticated airMAX M user to a malicious web page. The attack is network-reachable, requires no attacker privileges, and requires user interaction.
2
Who is exposed?
Organizations using Ubiquiti airMAX M devices are exposed when an authenticated user can be induced to visit attacker-controlled web content. The impact includes potential compromise of confidentiality, integrity, and availability of the device.