Ubiquiti airMAX M CVE-2026-116838

Exploitation requires (1) a victim who is an authenticated user with an active logged-in session on the airMAX M device's web management interface, and (2) that victim being lured into loading an attacker-controlled page while that session is active (CVSS UI:R). The CSRF weakness (CWE-352) means the attacker needs no credentials of their own - the device's own request-validation gap is what is abused to carry the command injection. Affected deployments are airMAX M firmware below 6.3.26. Limiting factors: the dependency on active admin authentication plus user interaction means this cannot be exploited unauthenticated against an idle device, and exposure is reduced where the management interface is not reachable and where administrators do not browse untrusted pages during active sessions.

This is a genuine priority, though a notch below drop-everything emergency. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw with no attacker privileges but requiring victim interaction, and full compromise impact (C:H/I:H/A:H) consistent with command injection yielding device takeover. The signals are internally consistent: the PR:N is correct for CSRF because the attacker holds no credentials and instead rides the session of an already-authenticated victim, while UI:R correctly captures that the victim must be lured to a malicious page. The counterbalancing signals temper urgency: EPSS is low at 0.38% (32nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' rather than act_now/emergency, matching the picture of a serious but not actively-exploited flaw. The low EPSS alongside the high CVSS is expected and not contradictory here, because successful exploitation depends on social-engineering a logged-in administrator - a real but non-trivial precondition that suppresses mass-scanning exploitation probability. Net: patch within the week as the vendor priority indicates; the impact ceiling is device compromise, but the user-interaction and session-state prerequisites make opportunistic internet-wide exploitation less likely than the raw 8.8 suggests.

An attacker crafts a malicious web page and lures an administrator who is currently logged into the airMAX M device's web interface into visiting it. The page silently issues a forged request to the device that abuses the CSRF weakness to inject and execute an operating-system command, giving the attacker control of the device. No public exploit has been identified at time of analysis, and the attack depends on the victim being authenticated and clicking through to the attacker's page.