CISA Advisory: PayRange API Missing Authorization Vulnerability (CVE-2026-18965)

CISA released an advisory on August 25, 2026, regarding a vulnerability (CVE-2026-18965) in PayRange API, a product used in commercial facilities. The vulnerability is due to missing authorization on management endpoints, allowing verbose details of every device on the PayRange network to be publicly accessible with or without an account. Successful exploitation could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a device's displayed image. The CVSS base score is 8.8 (High) under CVSS v3.1 and 8.7 (High) under CVSS v4.0. PayRange has not responded to CISA's requests to mitigate the vulnerability. CISA recommends defensive measures such as minimizing network exposure, using firewalls, and isolating control system networks. No known public exploitation has been reported at this time.