CVE-2026-21639

MEDIUM

UI airMAX AC <8.7.21, airMAX M <6.3.24, airFiber AF60-XG <1.2.3, AF60 <2.6.8 - RCE via airMAX Protocol

Title source: llm

Description

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier) Mitigation: Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version 2.6.8 or later.

References (1)

Core 1

Core References

Vendor Advisory

https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba

Scores

CVSS v3 5.4

EPSS 0.0027

EPSS Percentile 18.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-77

Status published

Products (4)

ui/airfiber_af60-xg_firmware < 1.2.3

ui/airfiber_af60_firmware < 2.6.8

ui/airmax_ac_firmware < 8.7.21

ui/airmax_m_firmware < 6.3.24

Published Jan 08, 2026

Tracked Since Feb 18, 2026