CVE-2026-101891CWE-284CWE-923broken-access-control

CVE-2026-101891

published September 28, 2026

CVSS
9.3
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00273 · 18.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints
Published
2026-09-28T21:17Z
References (1)
https://psirt.watchguard.com/CVE-2026-101891 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 16:51Z
    WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
    cvelistv5