Ubiquiti airMAX M CVE-2026-116837

Exploitation requires the attacker to have access to the adjacent network (CVSS AV:A) - i.e. the same wireless link or local L2 segment as the target device, not remote internet reachability; this adjacency requirement is the primary limiting factor. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, and the description names no special feature, mode, or non-default configuration as a prerequisite, so default deployments of the affected products - airMAX M, LTU PTMP, LTU PTP, and SolarPoint/SolarSwitch - appear exploitable once adjacency is achieved. Affected (unpatched) versions are airMAX M below 6.3.26, LTU PTMP below 2.4.2, LTU PTP below 1.5.7, and SolarPoint/SolarSwitch below 2.0.3; updating to or above those versions removes exposure.

Signals are moderately aligned toward a real but not emergency-tier priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 8.8) describes an unauthenticated, low-complexity path to full code execution, but the adjacent-network attack vector (AV:A) is the key constraint - the attacker must already be on the same radio/L2 segment, not the open internet, which materially narrows the threat population compared to an AV:N flaw. The EPSS score is low (0.21%, 12th percentile), there is no CISA KEV listing, and no public exploit is identified, so the current evidence points to potential rather than demonstrated mass exploitation. The vuln.today decision label is 'this_week' and a vendor patch is available, which is consistent: this is a credible high-severity bug warranting prompt patching, not a high-CVSS-but-trivial issue, yet the low EPSS and AV:A scope argue against treating it as an internet-wide emergency. Note the mild tension between the 8.8 base score (driven by full CIA impact) and the low real-world exploitation probability - this most likely reflects the adjacency requirement and the absence of observed in-the-wild activity rather than a data error.

An attacker positioned on the adjacent wireless/L2 network of an affected Ubiquiti device (for example, an associated client on the same airMAX/LTU link or a device on the same local segment) sends crafted input that overflows a heap buffer in the device firmware. Successful exploitation yields arbitrary code execution on the device without any authentication or user interaction. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-122 classification rather than a demonstrated PoC.