Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
A Stored Cross-Site Scripting (XSS) vulnerability in airMAX M devices that allows privilege escalation when exploited under certain conditions.
An unauthenticated attacker on the adjacent network can exploit this vulnerability with user interaction to escalate privileges on the device, gaining high-level access to compromise device confidentiality, integrity, and availability.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch is available. Update airMAX M firmware to version 6.3.26 or later.
Immediately update airMAX M devices to firmware version 6.3.26 or later. Restrict network access to these devices from untrusted adjacent networks. Implement network segmentation to limit exposure. Monitor for suspicious XSS payloads in device logs and user interactions.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-116836 . See article
NVD published the first details for CVE-2026-116836
A CVSS base score of 8.8 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-5c39-2376-cxh9] A malicious actor with access to the adjacent network and under certain conditio
CVE-2026-116836 - Exploits & Severity - Feedly
CVE-2026-116836: Cross-Site Scripting (XSS) - Analysis & Fix
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site…
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
