CVE-2026-21639

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-08 · updated 2026-07-30
Weakness: CWE-120

Description

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

Affected products

Ui Airfiber Af60-Xg Firmware: before 1.2.3 — fixed in 1.2.3
Ui Airfiber Af60 Firmware: before 2.6.8 — fixed in 2.6.8
Ui Airmax Ac Firmware: before 8.7.21 — fixed in 8.7.21
Ui Airmax M Firmware: before 6.3.24 — fixed in 6.3.24

How to fix

Upgrade to a fixed version: Ui Airfiber Af60-Xg Firmware 1.2.3; Ui Airfiber Af60 Firmware 2.6.8; Ui Airmax Ac Firmware 8.7.21; Ui Airmax M Firmware 6.3.24. Check the vendor advisory for mitigations.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-061-061/1e4fe5f8-29c7-4a7d-a518-01b1537983ba

Get alerted when CVE-2026-21639 or the next vulnerability affects your stack