CVE-2026-116839: CSRF
Published Oct 27, 2026
·Updated
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
Affected Software
1 affected component
Ubiquiti airMAX M
Event History
Oct 27, 2026
CVE Published
via MITRE·12:51 AM
Data Sourced
via MITRE·12:51 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Organizations using Ubiquiti airMAX M devices are exposed when an authenticated user can be lured into visiting a malicious page.
2
What does an attacker need to exploit it?
The attacker does not need prior privileges, but exploitation requires user interaction: an authenticated user must visit an attacker-controlled malicious page.
3
What could exploitation allow?
A successful CSRF attack can cause unauthorized changes on the device and may be used to deny service.