TI-2026-81003 Aliases CVE-2026-116837 GHSA-wmfj-f5h9-4hfc

Heap-based buffer overflow in Ubiquiti airMAX and LTU devices

LOW 39CWE-122Published 2026-10-27 · Updated 2026-11-03

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Ubiquiti airMAX M, LTU PTMP, LTU PTP, and SolarPoint / SolarSwitch devices before the fixed versions contain a heap-based buffer overflow (CWE-122). An unauthenticated attacker on the adjacent network can exploit it to execute arbitrary code on the device.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00214 11th percentileScored 2026-11-07

Fix Fixed airMAX M (Ubiquiti Inc): 6.3.26LTU PTMP (Ubiquiti Inc): 2.4.2+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ubiquiti	airMAX M	before 6.3.26	6.3.26	Patch available	CNA
Ubiquiti	LTU PTMP	before 2.4.2	2.4.2	Patch available	CNA
Ubiquiti	LTU PTP	before 1.5.7	1.5.7	Patch available	CNA
Ubiquiti	SolarPoint / SolarSwitch	before 2.0.3	2.0.3	Patch available	CNA

airMAX M VendorUbiquiti Affected before 6.3.26 Fixed in 6.3.26 Patch available CNA
LTU PTMP VendorUbiquiti Affected before 2.4.2 Fixed in 2.4.2 Patch available CNA
LTU PTP VendorUbiquiti Affected before 1.5.7 Fixed in 1.5.7 Patch available CNA
SolarPoint / SolarSwitch VendorUbiquiti Affected before 2.0.3 Fixed in 2.0.3 Patch available CNA

Remediation

Update airMAX M to 6.3.26, LTU PTMP to 2.4.2, LTU PTP to 1.5.7, and SolarPoint / SolarSwitch to 2.0.3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Fix · CNA airMAX M (Ubiquiti Inc) Fixed in 6.3.26
Fix · CNA LTU PTMP (Ubiquiti Inc) Fixed in 2.4.2
Fix · CNA LTU PTP (Ubiquiti Inc) Fixed in 1.5.7
Fix · CNA SolarPoint / SolarSwitch (Ubiquiti Inc) Fixed in 2.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-27
Ubiquiti airMAX M 6.3.26
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-81004 Ubiquiti airMAX M CSRF flaw allows command injection on devicesPriority MEDIUM 40
- TI-2026-81002 Stored XSS in Ubiquiti airMAX M allows adjacent-network privilege escalationPriority LOW 39
- TI-2026-81005 Cross-site request forgery in Ubiquiti airMAX M devicesPriority LOW 30
Show all 4 records →

Timeline

2026-10-27 Threatist record created from CVE-2026-116837
2026-10-27 Alias added: GHSA-wmfj-f5h9-4hfc
2026-10-27 Priority changed: MEDIUM → LOW
2026-11-03 CISA SSVC decision points changed

References

Other 1

https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3

TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8

See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences