CVE-2026-116838
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
Risk Assessment
Command injection on an airMAX M device may allow an attacker to take control of the device and conduct further network activities.
Recommendation
Update airMAX M device firmware to a patched version and restrict administrative panel access to trusted networks.
Other vulnerabilities in airMAX M
See all- CVE-2026-116839High
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
- CVE-2026-116836High
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
Original NVD description (English source)
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS