LiveThreat Vulnerability Brief — CVE-2026-21633
What It Is — A cleartext‑transmission information‑disclosure flaw in Ubiquiti Networks AI Pro that lets an unauthenticated, network‑adjacent attacker retrieve stored credentials. Exploitability — Proof‑of‑concept demonstrated at Pwn2Own; no known wild exploit, CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Products — Ubiquiti Networks AI Pro (all firmware versions prior to the February 2026 security update).
TPRM Impact — Compromise of AI Pro devices can expose internal network credentials, creating a supply‑chain foothold that may affect downstream partners, cloud‑hosted services, and any organization that relies on Ubiquiti networking gear.
Recommended Actions — Deploy Ubiquiti’s February 2026 firmware patch immediately; disable the legacy authentication method; rotate all credentials stored on the device; monitor network traffic for cleartext authentication attempts; validate the patch in a test environment before full rollout. Source: Zero Day Initiative advisory