{"id":"CVE-2026-116836","kind":"vulnerability","aliases":["CVE-2026-116836"],"related":[],"title":"airMAX M devices: stored XSS lets adjacent attacker escalate privileges","description":"A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.","summary":"airMAX M wireless devices contain a stored cross-site scripting flaw in their web interface. An attacker on the adjacent network can use it under certain conditions to escalate privileges on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["airmax-m","infrastructure","network-devices","ubiquiti"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:12+00:00","updated_at":"2026-10-27T01:36:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T01:36:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"airMAX M devices: stored XSS lets adjacent attacker escalate privileges","impact":"high","summary":"airMAX M wireless devices contain a stored cross-site scripting flaw in their web interface. An attacker on the adjacent network can use it under certain conditions to escalate privileges on the device.","category":"infrastructure","nicknames":[],"who_cares":["airmax-m","ubiquiti","network-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker escalates privileges on the device via injected script","analyst_note":"Find the vendor advisory and affected/fixed firmware versions for airMAX M; the NVD entry alone gives no versions or conditions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Operators of Ubiquiti airMAX M devices on a network where an attacker could reach them. The sources do not name affected firmware versions or the specific conditions required. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000528,"input_tokens":3286,"output_tokens":398,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116836':13A,16A '-2026':12A,15A 'access':63C 'actor':61C 'adjac':7A,45B,66C 'airmax':1A,18B,25B,84C 'airmax-m':17B 'attack':8A,42B 'certain':51B,70C 'condit':52B,71C 'contain':29B 'could':72C 'cross':33B,77C 'cross-sit':32B,76C 'cve':11A,14A 'devic':3A,23B,28B,58B,86C,92C 'escal':9A,54B,88C 'exploit':73C 'flaw':36B 'found':82C 'infrastructur':20B 'interfac':40B 'let':6A 'm':2A,19B,26B,85C 'malici':60C 'network':22B,46B,67C 'network-devic':21B 'privileg':10A,55B,89C 'script':35B,79C 'site':34B,78C 'store':4A,31B,75C 'ubiqu':24B 'use':48B 'vulner':81C 'web':39B 'wireless':27B 'xss':5A,80C","nicknames":[],"mitigations":[],"who_affected":"Operators of Ubiquiti airMAX M devices on a network where an attacker could reach them. The sources do not name affected firmware versions or the specific conditions required. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"fe490ce8-0395-4072-90d8-2707e1bdf984","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116836","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}