Vulnerability · Published Jan 8, 2026 · Assigned by hackerone
CVE-2026-21638
High 8.8
In plain English
A high-severity command injection in UBB from Ubiquiti Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti Inc | UBB-XG | 0 – before 1.2.3 |
| Ubiquiti Inc | UDB-Pro/UDB-Pro-Sector | 0 – before 1.4.2 |
| Ubiquiti Inc | UBB | 0 – before 3.1.7 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H