PayRange API
PayRange API vulnerability CVE-2026-18965 allows sensitive data disclosure and DoS.
A critical vulnerability, CVE-2026-18965, has been identified in the PayRange API, affecting all versions. This flaw allows remote attackers, authenticated or not, to disclose sensitive information, cause denial of service, or alter device display images due to missing authorization on management endpoints. PayRange has not yet responded to CISA's requests for mitigation, leaving users in the United States and Canada vulnerable.
AI summary of the linked source. Not reviewed by an editor. How this works
Run PayRange?
Get an email when a new story names PayRange, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe core failure in the PayRange API vulnerability (CVE-2026-18965) is the absence of proper authorization checks on management endpoints, allowing both unauthenticated and authenticated attackers to access sensitive data, disrupt service, or manipulate device displays. This is a fundamental access control design flaw, not merely a misconfiguration, meaning all deployed versions are affected with no vendor patch available. The lack of response from PayRange to CISA's mitigation requests compounds the risk, leaving organizations with no official remediation path. This matters because payment infrastructure APIs handle sensitive transactional and device data, making them high-value targets for fraud, disruption, and data theft.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-18965