LiveThreat Vulnerability Brief — CVE-2026-21634
What It Is — A parsing flaw in the WebSocket header handling of Ubiquiti Networks’ AI Pro appliance triggers an uncaught exception, resulting in a denial‑of‑service condition. Exploitability — Unauthenticated, network‑adjacent attackers can trigger the DoS; proof‑of‑concept demonstrated at Pwn2Own; CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Products — Ubiquiti Networks AI Pro (all firmware versions prior to the February 2026 security update).
TPRM Impact — Organizations that embed AI Pro in their infrastructure face potential service disruption, SLA violations, and downstream impact on customers and partners.
Recommended Actions — Deploy the vendor‑issued firmware update immediately; verify all AI Pro devices run the patched version; segment management traffic; add WebSocket anomaly detection; update incident‑response playbooks for DoS scenarios. Source: Zero Day Initiative Advisory