---
id: "CVE-2026-116837"
kind: "vulnerability"
aliases: ["CVE-2026-116837"]
title: "Ubiquiti airMAX devices: heap overflow lets adjacent attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["adjacent-network", "airmax", "infrastructure", "ltu", "solarpoint", "solarswitch", "ubiquiti", "wireless-network-gear"]
not_affected_if: []
published_at: "2026-10-27T01:19:06+00:00"
first_seen_at: "2026-10-27T01:34:33+00:00"
updated_at: "2026-10-27T01:36:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116837", "first_seen_at": "2026-10-27T01:34:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T01:36:52+00:00"}]
---

# Ubiquiti airMAX devices: heap overflow lets adjacent attacker run code

A heap-based buffer overflow in Ubiquiti airMAX M, LTU, SolarPoint and SolarSwitch devices can be triggered by an attacker on the adjacent network. Successful exploitation lets the attacker execute arbitrary code on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-27T01:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116837
- 2026-10-27T01:36:52+00:00 analyst — Ubiquiti bulletin for this CVE not found yet (latest published: 070 on 2026-10-14; 071 not indexed). Fixed versions unknown; not guessing from the UISP release list (airMAX M 6.3.26, LTU PTMP 2.4.2, LTU PTP 1.5.7, SolarPoint/SolarSwitch 2.0.3 exist but no page ties them to this CVE). Recheck community.ui.com/releases for a new Security Advisory Bulletin.

## From the sources

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_