Ubiquiti airMAX M CVE-2026-116836

Exploitation requires adjacent-network access to the airMAX M device (AV:A) - e.g., a position on the same local/wireless segment - plus user interaction (UI:R): a victim, most plausibly an administrator, must view the page containing the attacker's stored XSS payload for the script to execute and privilege escalation to occur. The description further limits exploitation to 'under certain conditions,' which are not specified in the available sources; this unstated prerequisite is a real limiting factor and should be confirmed with the vendor. Authentication is not required to trigger per PR:N, but the dependence on a victim viewing stored content and on the unspecified conditions meaningfully narrows realistic exploitation versus a straight unauthenticated-remote flaw. Affected deployments are airMAX M firmware before 6.3.26.

Signals are moderate-to-elevated but not emergency-grade. The CVSS 3.1 base score is 8.8 (High) driven by adjacent-network vector (AV:A), low complexity (AC:L), no privileges required (PR:N), and a changed scope (S:C) with high confidentiality, integrity and availability impact - consistent with a stored XSS that, once triggered, lets an attacker act in the context of an authenticated/administrative session on the device. However, the CVSS vector requires user interaction (UI:R), and the description itself qualifies exploitation as possible only 'under certain conditions,' so successful attack depends on a victim (likely an administrator) viewing the attacker-injected content and on those unstated conditions being met. Counter-signals lower the real-world urgency: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_week,' which aligns with a patch-this-week posture rather than drop-everything. Net: a genuine high-severity flaw worth prompt patching given it is network-adjacent and requires no authentication, but current exploitation-likelihood data suggests it is not under widespread active attack. Note the tension to verify with the vendor: the description's 'under certain conditions' phrasing is vaguer than the clean AC:L/PR:N vector implies, so the practical preconditions should be confirmed against the Ubiquiti advisory.

An attacker on the same adjacent network (e.g., an associated wireless client or someone on the local segment) injects a malicious script into a stored field of the airMAX M device's management interface. When an administrator subsequently views the affected page, the stored script executes in their session and is used to escalate privileges on the device. No public exploit code or PoC reference is identified in the available data.