CVE-2026-101891

9.3 criticalEPSS 0.3%

Critical (9.3). EPSS 0.3% chance of exploitation in the next 30 days.

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-923
Published: 2026-09-28
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://psirt.watchguard.com/CVE-2026-101891

Check your stack JSON