PayRange API: 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in PayRange PayRange API. Weakness type: Missing Authorization. Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
At a glance
- Vendor
- PayRange
- Products
- PayRange API
- CVEs
- CVE-2026-18965
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities
- Deployed
- United States, Canada
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-18965 | Missing Authorization | 8.8 | – | No | The affected product is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account. |
Affected products (1)
- PayRange PayRange API: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: PayRange has not responded to requests to work with CISA to mitigate this vulnerability. Users of PayRange devices are invited to contact PayRange customer support at [email protected] for additional information. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.