CVE-2026-116836：Ubiquiti airMAX M 儲存型 XSS 許可權提升漏洞
CVE-2026-116836 - Ubiquiti airMAX M Stored Cross-Site Scripting Privilege Escalation
CVE-2026-116836 讓攻擊者在相鄰網路下利用 airMAX M 裝置的儲存型 XSS 漏洞提升許可權。
- 漏洞型別：儲存型 XSS，導致許可權提升。
此 CVE 允許攻擊者透過儲存型 XSS 提升許可權，提醒使用者即時升級韌體並限制網路存取，以防止潛在的許可權濫用。
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
Impact
Affected Products
The following products are affected by CVE-2026-116836
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | fe490ce8-0395-4072-90d8-2707e1bdf984 |
Patch airMAX M devices to fix privilege escalation via Stored XSS.
- Update airMAX M device firmware.
- Restrict network access to airMAX M devices.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-116836 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.