Two vulnerabilities. Remote code execution, over the air, with no authentication required. That’s the short version of what our research team found in Ubiquiti AirMax, the antennas that bring internet to places where laying fiber isn’t practical, and that also connect security cameras and buildings across long distances.
Here’s everything you need to know, starting with the facts.
The Vulnerabilities
CVEs
- CVE-2026-21639 — Remote code execution in the airMAX Wireless Protocol, affecting airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60.
- CVE-2026-21638 — The same class of remote code execution, affecting UBB-XG, UDB-Pro/UDB-Pro-Sector, and UBB.
Both were discovered by Gastón Aznarez, Principal Security Researcher at Faraday, with support from Federico Kirschbaum y Dan Borgogno.
Security Advisories
Ubiquiti published two official advisories covering these findings on 6 de enero de 2026:
- Security Advisory Bulletin 061 — covers CVE-2026-21639
- Security Advisory Bulletin 060 — covers CVE-2026-21638
Both describe the same underlying issue: “A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.”
Criticality
Both CVEs were rated 8.8 (High) on the CVSS v3.1 scale:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HIn plain terms, that vector string means:
- AV:A (Attack Vector: Adjacent) — the attacker doesn’t need to be on the same local network, just within radio range. For AirMax, “adjacent” can mean kilometers away, not just next door.
- AC:L (Attack Complexity: Low) — no special conditions or timing needed to pull it off.
- PR:N (Privileges Required: None) — no account, no credentials.
- UI:N (User Interaction: None) — nobody on the target end has to click, approve, or do anything.
- C:H / I:H / A:H (High impact on Confidentiality, Integrity, and Availability) — a successful attack means full compromise of the device.
Affected Devices
| Product | Affected versions | Fixed in | CVE |
|---|---|---|---|
| airMAX AC | 8.7.20 and earlier | 8.7.21 or later | CVE-2026-21639 |
| airMAX M | 6.3.22 and earlier | 6.3.24 or later | CVE-2026-21639 |
| airFiber AF60-XG | 1.2.2 and earlier | 1.2.3 or later | CVE-2026-21639 |
| airFiber AF60 | 2.6.7 and earlier | 2.6.8 or later | CVE-2026-21639 |
| UBB-XG | 1.2.2 and earlier | 1.2.3 or later | CVE-2026-21638 |
| UDB-Pro / UDB-Pro-Sector | 1.4.1 and earlier | 1.4.2 or later | CVE-2026-21638 |
| UBB | 3.1.5 and earlier | 3.1.7 or later | CVE-2026-21638 |
Seven product families in total, adding up to more than 50 individual models still sold and actively used today.
How to Fix This: Update to the New Versions
The fix is straightforward: update to the version listed above or later for your specific product.
If you’re not sure whether you’re affected, check your device’s current firmware version against the tables above. If you or your business runs any of these products, update as soon as possible.
In practice, many of these antennas are installed and managed by an internet provider rather than the end customer. If that’s your situation, the fastest path is simply asking your provider to confirm they’re running a patched version.
Attack Scenario
Here’s what made this so severe: an attacker didn’t need a password, didn’t need to be connected to the network, and didn’t need physical access to the device. All it took was being within range of the signal and sending a specially crafted wireless frame.
Digging into how AirMax works, the team found that its proprietary protocol hides inside vendor-specific fields in standard Wi-Fi management frames. Some of that data looked encrypted at first glance, but it wasn’t; it was only disguised, not actually locked. On top of that, several affected models were still running on internal software roughly 17 years old, unsupported for nearly a decade.
Put together, those two things opened the door to remote code execution using only a wireless signal, no cable, no login, no physical contact.
Where This Equipment Lives
This isn’t infrastructure tucked away in a data center, it’s mounted on rooftops in plain sight, all over the world, especially in regions where fiber optic coverage is limited or too costly to deploy.
This research was carried out by Gastón Aznarez, Federico Kirschbaumproyectos de Dan Borgogno, and was presented at two of the world’s biggest cybersecurity conferences: Black Hat USA 2026 y DEF CON 34.
Proving It Was Real
To show this wasn’t just a theory, the team ran a real demonstration on the streets of Buenos Aires: they placed a vulnerable antenna inside a cardboard box, set up a second antenna in a nearby building to send the attack, and simply started walking away, watching it work from a city sidewalk. No cables, no physical access, no lab. Just the open air.
The Team Behind the Research
Mostrar imagen
This research was carried out by Gastón Aznarez, Federico Kirschbaumproyectos de Dan Borgogno, and was presented at two of the world’s biggest cybersecurity conferences: Black Hat USA 2026 y DEF CON 34.
Catch the Talk Live
The story doesn’t stop in Las Vegas. Over the next few weeks, the team will be taking “Root From Kilometers Away” on the road to three more security conferences:
- SEC-T — Stockholm, Sweden — September 9–11
- Off By One Singapore (OB1) — Singapore — September 14–15
- NOPcon — Istanbul, Turkey — September 17–18
Stay tuned, we’ll keep sharing updates as the talk travels.
At the end of the day, this is a reminder that security isn’t only about the software running on our phones and laptops. It’s also about the quiet, easy-to-forget devices sitting on rooftops, connecting entire communities to the internet, devices that deserve just as much attention.
Links
https://nvd.nist.gov/vuln/detail/cve-2026-21639
