What is the CVSS score of CVE-2026-21639?

CVE-2026-21639 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ubiquiti airMAX are affected by CVE-2026-21639?

Ubiquiti airMAX and airFiber wireless devices (AC, M, and AF60 series) contain a remote code execution vulnerability accessible to unauthenticated attackers within radio range, enabling complete…

How to fix or mitigate CVE-2026-21639?

Within 24 hours: identify and inventory all Ubiquiti airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60 devices, documenting firmware versions against affected thresholds (AC ≤8.7.20, M ≤6.3.22, AF60-XG ≤1.2.2, AF60 ≤2.6.7). Within 7 days: isolate affected devices onto restricted VLANs with management access limited to secured administrative workstations, disable remote management where operationally feasible, and enable detailed access logging. Within 30 days: contact Ubiquiti support to confirm patch availability and timeline; deploy patches immediately upon release; if no patches materialize within your risk tolerance window, execute a hardware replacement strategy prioritizing devices in highest-risk locations.

Ubiquiti airMAX CVE-2026-21639

HIGH

Command Injection (CWE-77)

2026-01-08 support@hackerone.com

RCE Command Injection Airfiber Af60 Firmware Airfiber Af60 Xg Firmware Airmax Ac Firmware Airmax M Firmware Ui

8.8

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attack requires RF proximity (AV:A) but no authentication or interaction (PR:N/UI:N), and RCE yields full firmware compromise, so C/I/A all High.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 07:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 30, 2026 - 07:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 06:37 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 06:37 NVD

MEDIUM HIGH

CVSS changed

Jul 30, 2026 - 06:37 NVD

5.4 (MEDIUM) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 08, 2026 - 17:15 nvd

MEDIUM 5.4

DescriptionCVE.org

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

Affected Products:

airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier)

Mitigation:

Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version 2.6.8 or later.

AnalysisAI

Remote code execution in Ubiquiti airMAX and airFiber wireless devices lets an attacker within Wi-Fi range run arbitrary code by abusing the proprietary airMAX Wireless Protocol. The flaw (a command injection, CWE-77) affects airMAX AC (≤ 8.7.20), airMAX M (≤ 6.3.22), airFiber AF60-XG (≤ 1.2.2), and airFiber AF60 (≤ 2.6.7), and requires only radio proximity rather than network authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.07%), so exploitation is currently theoretical despite the high CVSS of 8.8.

Technical ContextAI

The affected devices are Ubiquiti outdoor point-to-point and point-to-multipoint radios (WISP/backhaul and last-mile links) running vendor firmware, identified by the CPEs cpe:2.3:o:ui:airmax_ac_firmware, airmax_m_firmware, airfiber_af60-xg_firmware, and airfiber_af60_firmware. The vulnerability lives in the airMAX Wireless Protocol - Ubiquiti's proprietary TDMA-based link-layer radio protocol used to establish and manage the wireless link before any IP-layer authentication occurs. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that attacker-controlled data received over the air is passed into a command/shell context without sanitization, allowing injected commands to execute on the embedded Linux firmware.

RemediationAI

Apply the vendor-released firmware updates: update airMAX AC to 8.7.21 or later, airMAX M to 6.3.24 or later, airFiber AF60-XG to 1.2.3 or later, and airFiber AF60 to 2.6.8 or later, per Ubiquiti Security Advisory Bulletin 061-061 (https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba). Because the attack requires RF proximity and there is no protocol-level workaround for a link-layer flaw, compensating controls until patching are physical/RF-oriented: reduce transmit power and use tight antenna alignment to limit the radio footprint accessible to an attacker, physically secure and monitor tower/rooftop sites, and where feasible temporarily take down or restrict exposed links in high-risk locations - noting these measures degrade link range/performance and do not eliminate risk for anyone able to get within radio range. Patching is the only complete fix.