{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21639", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-01-01T15:00:02.339Z", "datePublished": "2026-01-08T16:14:22.626Z", "dateUpdated": "2026-07-30T06:02:49.974Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Ubiquiti Inc", "product": "airMAX AC", "versions": [{"version": "0", "status": "affected", "lessThan": "8.7.21", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "Ubiquiti Inc", "product": "airMAX M", "versions": [{"version": "0", "status": "affected", "lessThan": "6.3.24", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "Ubiquiti Inc", "product": "airFiber AF60-XG", "versions": [{"version": "0", "status": "affected", "lessThan": "1.2.3", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "Ubiquiti Inc", "product": "airFiber AF60", "versions": [{"version": "0", "status": "affected", "lessThan": "2.6.8", "versionType": "semver"}]}], "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-120", "description": "CWE-120 Classic Buffer Overflow"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:49.974Z"}, "x_gcve": [{"vulnId": "CVE-2026-21639", "recordType": "advisory"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T17:09:52.634464Z", "id": "CVE-2026-21639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T17:21:53.724Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-21639", "date": "2026-11-08", "epss": "0.00392", "percentile": "0.33602"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-21639\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2026-01-08T17:15:50.483\",\"lastModified\":\"2026-07-30T06:25:51.670\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.\"},{\"lang\":\"es\",\"value\":\"Un actor malicioso dentro del alcance Wi-Fi del producto afectado podr\u00eda aprovechar una vulnerabilidad en el Protocolo Inal\u00e1mbrico airMAX para lograr una ejecuci\u00f3n remota de c\u00f3digo (RCE) dentro del producto afectado.\\n\\nProductos Afectados:\\nairMAX AC (Versi\u00f3n 8.7.20 y anteriores)\\nairMAX M (Versi\u00f3n 6.3.22 y anteriores)\\nairFiber AF60-XG (Versi\u00f3n 1.2.2 y anteriores)\\nairFiber AF60 (Versi\u00f3n 2.6.7 y anteriores)\\n\\nMitigaci\u00f3n:\\nActualice su airMAX AC a la Versi\u00f3n 8.7.21 o posterior.\\nActualice su airMAX M a la Versi\u00f3n 6.3.24 o posterior.\\nActualice su airFiber AF60-XG a la Versi\u00f3n 1.2.3 o posterior.\\nActualice su airFiber AF60 a la Versi\u00f3n 2.6.8 o posterior.\"}],\"affected\":[{\"source\":\"support@hackerone.com\",\"affectedData\":[{\"vendor\":\"Ubiquiti Inc\",\"product\":\"airMAX AC\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"8.7.21\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"airMAX M\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"6.3.24\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"airFiber AF60-XG\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.2.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"airFiber AF60\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-08T17:09:52.634464Z\",\"id\":\"CVE-2026-21639\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ui:airmax_ac_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.7.21\",\"matchCriteriaId\":\"E6CAE32F-15CF-472D-9CB2-2B863A9FF429\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ui:airmax_ac:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7522076-32AA-4C46-A383-55496EB8E403\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ui:airmax_m_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.3.24\",\"matchCriteriaId\":\"23228893-D868-4C84-82A8-3AAA30193F95\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ui:airmax_m:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22401E7D-9BB7-4015-A28B-1C134C429E56\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ui:airfiber_af60-xg_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.2.3\",\"matchCriteriaId\":\"C7197F20-55D0-4EF4-9C97-60A56E888427\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ui:airfiber_af60-xg:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE317510-2899-438A-9C95-83A6C7FA1B2F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ui:airfiber_af60_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.6.8\",\"matchCriteriaId\":\"F1C29843-49DD-4B68-89C6-14E3CFB70E62\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ui:airfiber_af60:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30F52A22-F069-426B-8664-E94E41E3863E\"}]}]}],\"references\":[{\"url\":\"https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]}]}}", "redhat_vex": {"current_release_date": "2026-01-10T05:41:08+00:00", "cve": "CVE-2026-21639", "id": "CVE-2026-21639", "initial_release_date": "2026-01-01T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "CVE-2026-21639", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21639.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21639\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-08T17:09:52.634464Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-08T17:21:36.953Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Ubiquiti Inc\", \"product\": \"airMAX AC\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.7.21\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"airMAX M\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.3.24\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"airFiber AF60-XG\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.2.3\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"airFiber AF60\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.6.8\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.\\r\\n\\r\\n \\r\\n\\r\\nAffected Products:\\r\\n\\r\\nairMAX AC (Version 8.7.20 and earlier)\\r\\nairMAX M (Version 6.3.22 and earlier)\\r\\nairFiber AF60-XG (Version 1.2.2 and earlier)\\r\\nairFiber AF60 (Version 2.6.7 and earlier)\\r\\n\\r\\n \\r\\n\\r\\nMitigation:\\r\\n\\r\\nUpdate your airMAX AC to Version 8.7.21 or later.\\r\\nUpdate your airMAX M to Version 6.3.24 or later.\\r\\nUpdate your airFiber AF60-XG to Version 1.2.3 or later.\\r\\nUpdate your airFiber AF60 to Version 2.6.8 or later.\"}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2026-01-08T16:14:22.626Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-21639\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-08T17:21:53.724Z\", \"dateReserved\": \"2026-01-01T15:00:02.339Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2026-01-08T16:14:22.626Z\", \"assignerShortName\": \"hackerone\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}