Ubiquiti airMAX M CVE-2026-116839

Exploitation requires that a user already authenticated to the airMAX M device web/management interface (with a valid active session) be lured into loading an attacker-controlled page in the same browser - this user interaction (UI:R) is the central prerequisite and the main limiting factor. No attacker credentials to the device are needed (PR:N), but the forged request only succeeds against the victim's authenticated session, so devices whose administrators do not browse untrusted content while logged in are not practically exposed. Affected deployments are airMAX M running firmware below 6.3.26; upgrading to 6.3.26 or later removes exposure. The exact unprotected endpoint/feature is not specified in the available sources.

This is a moderate-severity CSRF (CWE-352) in Ubiquiti airMAX M devices, rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). The vector shows network reach and low complexity with no attacker privileges (PR:N), but it is gated by required user interaction (UI:R): the attack only works if an authenticated administrator is lured to a malicious page while holding a live session on the device. The impact profile is the telling signal - no confidentiality impact (C:N), limited integrity impact (I:L, 'unauthorized changes'), and high availability impact (A:H, a DoS of the device). The exploitation signals are low and consistent: EPSS is 0.10% (1st percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - the only references are the Ubiquiti security advisory and the NVD entry. The vuln.today priority is 'this_week' and a vendor patch is available, so this is a patch-on-normal-cadence item rather than an emergency: a genuine but interaction-dependent and not-currently-exploited issue, not a high-CVSS-but-illusory one. The main residual risk is to environments where device operators routinely browse untrusted sites from management workstations with active device sessions.

An attacker crafts a web page containing a forged request targeting an airMAX M device's web interface and lures a logged-in administrator to visit it (e.g., via phishing or a malicious link). When the victim's browser loads the page, it silently submits the request using the victim's authenticated session, applying unauthorized configuration changes and triggering a denial of service on the device. No public exploit identified at time of analysis; the attack depends on the victim being authenticated and interacting with the malicious page.