CVE-2026-21639

HIGH

8.8

CVSS Score

Published: January 8, 2026 at 04:14 PM UTC

Updated: July 30, 2026 at 06:42 AM UTC

12 products affected across 2 vendorsAirmax Ac FirmwareAirfiber AF60 FirmwareAirfiber Af60-xg Firmware

Using airMAX AC by Ubiquiti Inc?

Get instant alerts when new vulnerabilities affect airMAX AC - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier) Mitigation: Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version 2.6.8 or later.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Airfiber AF60 Firmware · UI

95%

v < 2.6.8

Affected range stops below 2.6.8, so it looks safe — our inference, not a vendor statement

ui-airfiber-af60 (same device)

Airfiber Af60-xg Firmware · UI

95%

v < 1.2.3

Affected range stops below 1.2.3, so it looks safe — our inference, not a vendor statement

ui-airfiber-af60-xg (same device)

Airmax Ac Firmware · UI

95%

v < 8.7.21

Affected range stops below 8.7.21, so it looks safe — our inference, not a vendor statement

ui-airmax-ac (same device)

Airmax M Firmware · UI

95%

v < 6.3.24

Affected range stops below 6.3.24, so it looks safe — our inference, not a vendor statement

ui-airmax-m (same device)

airFiber AF60 · Ubiquiti

60%

v < 2.6.8

Affected range stops below 2.6.8, so it looks safe — our inference, not a vendor statement

airFiber AF60-XG · Ubiquiti

60%

v < 1.2.3

Affected range stops below 1.2.3, so it looks safe — our inference, not a vendor statement

airMAX AC · Ubiquiti

60%

v < 8.7.21

Affected range stops below 8.7.21, so it looks safe — our inference, not a vendor statement

airMAX M · Ubiquiti

60%

v < 6.3.24

Affected range stops below 6.3.24, so it looks safe — our inference, not a vendor statement

Airfiber Af60 · UIdevice

80%

All versions

Airfiber Af60-Xg · UIdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba

References (1)

Vendor Advisory

Source: cverecord

https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHhackerone

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-120CWE-77

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card