CVE-2026-21639: airMAX Wireless Protocol RCE Vulnerability

CVE-2026-21639 Overview

CVE-2026-21639 is a command injection vulnerability (CWE-77) in the airMAX Wireless Protocol used by Ubiquiti networking products. A malicious actor within Wi-Fi range of an affected device can exploit this vulnerability to achieve remote code execution (RCE). The attack requires adjacent network access, meaning the attacker must be physically close enough to communicate with the vulnerable device over the wireless network.

Critical Impact

Successful exploitation allows an attacker in Wi-Fi range to execute arbitrary commands on vulnerable Ubiquiti airMAX and airFiber devices, potentially compromising network infrastructure and enabling lateral movement.

Affected Products

• airMAX AC (Version 8.7.20 and earlier)
• airMAX M (Version 6.3.22 and earlier)
• airFiber AF60-XG (Version 1.2.2 and earlier)
• airFiber AF60 (Version 2.6.7 and earlier)

Discovery Timeline

• 2026-01-08 - CVE CVE-2026-21639 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21639

Vulnerability Analysis

This vulnerability resides in the airMAX Wireless Protocol implementation across multiple Ubiquiti product lines. The flaw is classified as CWE-77 (Command Injection), indicating that user-controllable input is improperly processed and passed to system command execution functions without adequate sanitization.

The attack requires adjacent network access, meaning an attacker must be within Wi-Fi range of the vulnerable device. Once in range, no authentication or user interaction is required to exploit the vulnerability. While the attack has low complexity, the impact is limited to confidentiality and integrity compromise without affecting system availability.

The vulnerability affects firmware across several Ubiquiti product families, including both the airMAX wireless broadband systems and airFiber point-to-point links. These devices are commonly deployed in enterprise wireless infrastructure, ISP last-mile deployments, and point-to-point backhaul configurations.

Root Cause

The root cause is a command injection flaw (CWE-77) in the airMAX Wireless Protocol implementation. The protocol fails to properly sanitize or validate input before incorporating it into system commands, allowing an attacker to inject malicious commands that execute with the privileges of the affected service.

Attack Vector

The vulnerability is exploitable from an adjacent network position. An attacker must be within Wi-Fi range of the targeted device to communicate with it over the airMAX Wireless Protocol. The attack does not require any prior authentication or privileges on the target system, and no user interaction is needed for successful exploitation.

The adjacent network attack vector means that while the vulnerability is serious, exploitation requires physical proximity to the target device. This limits the attack surface compared to vulnerabilities exploitable over the internet, but still presents significant risk for devices deployed in accessible locations or environments where physical access control is limited.

Technical details regarding the specific exploitation mechanism can be found in the Ubiquiti Security Advisory 061.

Detection Methods for CVE-2026-21639

Indicators of Compromise

• Unusual or unexpected wireless clients attempting to associate with airMAX or airFiber devices
• Anomalous command execution or process spawning on affected devices
• Unexpected outbound network connections from wireless infrastructure devices
• Modified configuration files or firmware on affected devices

Detection Strategies

• Monitor wireless access logs for suspicious connection attempts from unknown MAC addresses
• Implement network segmentation to isolate wireless infrastructure management interfaces
• Deploy intrusion detection systems capable of analyzing wireless protocol traffic
• Regularly audit device firmware versions against known vulnerable versions

Monitoring Recommendations

• Enable logging on all Ubiquiti airMAX and airFiber devices and forward logs to a centralized SIEM
• Monitor for firmware modifications or configuration changes outside of maintenance windows
• Establish baseline behavior for wireless infrastructure devices and alert on deviations
• Implement wireless intrusion detection to identify rogue devices attempting protocol-level attacks

How to Mitigate CVE-2026-21639

Immediate Actions Required

• Inventory all Ubiquiti airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60 devices in your environment
• Apply the appropriate firmware updates immediately to all affected devices
• Restrict physical access to locations where vulnerable devices can be reached via Wi-Fi
• Monitor affected devices for signs of compromise until patches are applied

Patch Information

Ubiquiti has released firmware updates to address this vulnerability. Update your devices to the following minimum versions:

• airMAX AC: Update to Version 8.7.21 or later
• airMAX M: Update to Version 6.3.24 or later
• airFiber AF60-XG: Update to Version 1.2.3 or later
• airFiber AF60: Update to Version 2.6.8 or later

For complete patch details, refer to the Ubiquiti Security Advisory 061.

Workarounds

• Reduce wireless transmission power to limit the range from which attacks can be launched
• Implement MAC address filtering where feasible to limit wireless client associations
• Deploy devices in physically secured locations to reduce exposure to adjacent network attacks
• Use network segmentation to isolate wireless infrastructure from critical systems

# Verify firmware version on Ubiquiti devices via SSH
# Connect to device and check current firmware
ssh admin@<device-ip>
cat /etc/version

# Ensure version meets or exceeds:
# airMAX AC: 8.7.21
# airMAX M: 6.3.24
# airFiber AF60-XG: 1.2.3
# airFiber AF60: 2.6.8