CVE-2026-116837: Critical Buffer Overflow in Ubiquiti Devices

CVE-2026-116837 identifies a heap-based buffer overflow vulnerability in Ubiquiti airMAX M, LTU, SolarPoint and SolarSwitch devices. A malicious actor with access to the adjacent network can exploit the flaw to execute arbitrary code, gaining complete control of the device. It affects widely deployed wireless and solar generation infrastructure in enterprise environments.

The CVSS score is 8.8 (high). The vulnerability was published by NIST on October 27, 2026. Social media discussion has been limited to 1 post in the last 24 hours with 3 interactions total. Security researchers report a patch is already available from the vendor, reducing exposure for those who act quickly.

The primary defense strategy is inventory and immediate patch deployment on all production airMAX, LTU, SolarPoint and SolarSwitch devices. In parallel, review adjacent network access controls: segment traffic to these devices and restrict it to authorized sources to reduce exploitation risk even if patching is delayed.

Criticality is heightened by the infrastructural role of these devices: compromise or downtime directly impacts wireless network continuity and energy management systems. Administrators must coordinate updates to minimize downtime, ideally during planned maintenance windows.