{"id":"CVE-2026-116837","kind":"vulnerability","aliases":["CVE-2026-116837"],"related":[],"title":"Ubiquiti airMAX devices: heap overflow lets adjacent attacker run code","description":"A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.","summary":"A heap-based buffer overflow in Ubiquiti airMAX M, LTU, SolarPoint and SolarSwitch devices can be triggered by an attacker on the adjacent network. Successful exploitation lets the attacker execute arbitrary code on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adjacent-network","airmax","infrastructure","ltu","solarpoint","solarswitch","ubiquiti","wireless-network-gear"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:12+00:00","updated_at":"2026-10-27T01:36:52+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T01:36:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ubiquiti airMAX devices: heap overflow lets adjacent attacker run code","impact":"high","summary":"A heap-based buffer overflow in Ubiquiti airMAX M, LTU, SolarPoint and SolarSwitch devices can be triggered by an attacker on the adjacent network. Successful exploitation lets the attacker execute arbitrary code on the device.","category":"infrastructure","nicknames":[],"who_cares":["ubiquiti","airmax","wireless-network-gear"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the network device","analyst_note":"Sources give no affected firmware versions or vendor advisory; find the Ubiquiti advisory and fixed firmware versions for airMAX M, LTU, SolarPoint and SolarSwitch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000526,"input_tokens":3299,"output_tokens":393,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected firmware versions or vendor advisory; find the Ubiquiti advisory and fixed firmware versions for airMAX M, LTU, SolarPoint and SolarSwitch.","search":"'-116837':13A,16A '-2026':12A,15A 'access':70C 'actor':68C 'adjac':7A,18B,53B,73C 'adjacent-network':17B 'airmax':2A,20B,38B,86C 'arbitrari':61B,95C 'attack':8A,50B,59B 'base':33B,80C 'buffer':34B,81C 'code':10A,62B,96C 'could':75C 'cve':11A,14A 'devic':3A,44B,65B,92C,99C 'execut':60B,94C 'exploit':56B,76C 'found':84C 'gear':29B 'heap':4A,32B,79C 'heap-bas':31B,78C 'infrastructur':21B 'let':6A,57B 'ltu':22B,40B,88C 'm':39B,87C 'malici':67C 'network':19B,28B,54B,74C 'overflow':5A,35B,82C 'run':9A 'solarpoint':23B,41B,89C 'solarswitch':24B,43B,91C 'success':55B 'trigger':47B 'ubiqu':1A,25B,37B 'vulner':83C 'wireless':27B 'wireless-network-gear':26B","nicknames":[],"mitigations":[],"who_affected":"Ubiquiti airMAX M, LTU, SolarPoint and SolarSwitch devices are exposed to an attacker on the same network segment, with no login needed (CVSS vector AV:A/PR:N/UI:N). Look at radios and switches whose management or wireless network is shared with untrusted clients. Devices reachable only from a trusted, isolated management network are lower risk. Affected firmware versions are not yet confirmed from a Ubiquiti advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"fe490ce8-0395-4072-90d8-2707e1bdf984","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116837","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116837:848","url":null,"severity":null,"published_at":"2026-10-27T01:36:52+00:00","modified_at":"2026-10-27T01:36:52+00:00","first_seen_at":"2026-10-27T01:36:52+00:00","fetched_at":"2026-10-27T01:36:52+00:00","note":"Ubiquiti bulletin for this CVE not found yet (latest published: 070 on 2026-10-14; 071 not indexed). Fixed versions unknown; not guessing from the UISP release list (airMAX M 6.3.26, LTU PTMP 2.4.2, LTU PTP 1.5.7, SolarPoint/SolarSwitch 2.0.3 exist but no page ties them to this CVE). Recheck community.ui.com/releases for a new Security Advisory Bulletin."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}