Vulnerability · Published Jan 8, 2026 · Assigned by hackerone
CVE-2026-21639
High 8.8
In plain English
A high-severity buffer overflow in airFiber AF60 from Ubiquiti Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 66.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti Inc | airMAX AC | 0 – before 8.7.21 |
| Ubiquiti Inc | airMAX M | 0 – before 6.3.24 |
| Ubiquiti Inc | airFiber AF60-XG | 0 – before 1.2.3 |
| Ubiquiti Inc | airFiber AF60 | 0 – before 2.6.8 |
Weakness: CWE-120, CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H