CVE-2026-18965CWE-862broken-access-control

CVE-2026-18965

High · published August 28, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-28T04:16Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-04.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04 · [email protected]
EPSS history
Timeline
  • 27 AUG 20:34Z
    Missing Authorization in PayRange API
    cvelistv5