CVE-2026-18965: PayRange API Information Disclosure Flaw

CVE-2026-18965 Overview

CVE-2026-18965 is a missing authorization vulnerability [CWE-862] in the PayRange API. The flaw exposes management endpoints without proper access controls, allowing anyone to retrieve detailed information about every device on the PayRange network. Attackers can query these endpoints with or without a valid account. CISA published this issue as ICS advisory ICSA-26-237-04, reflecting its impact on operational technology and connected payment devices in the field.

Critical Impact
Unauthenticated or low-privilege network attackers can enumerate verbose device details across the entire PayRange fleet, undermining confidentiality, integrity, and availability of connected payment hardware.

Affected Products

PayRange API management endpoints
PayRange-connected payment devices exposed through the API
PayRange account and device management workflows

Discovery Timeline

2026-08-28 - CVE-2026-18965 published to the National Vulnerability Database
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-18965

Vulnerability Analysis

The PayRange API exposes management endpoints that return verbose device metadata without verifying the requester's authorization. Any client that reaches the API surface can enumerate devices across the entire PayRange network. The exposure applies whether the caller authenticates or connects anonymously, which eliminates the account boundary that would normally isolate tenants and operators.

The issue maps to CWE-862: Missing Authorization. The endpoints appear to enforce authentication or transport-layer protection while omitting the authorization checks that decide whether the current principal should see a given device record. As a result, low-friction requests return data that should be scoped to device owners or PayRange operators.

Root Cause

The management endpoints do not enforce object-level or role-based authorization before returning device data. Access decisions are missing between the API gateway and the data layer. Any caller reaching the endpoint receives verbose responses about arbitrary devices in the fleet.

Attack Vector

An attacker sends HTTP requests directly to the PayRange management API over the network. No user interaction and no elevated privileges are required. The attacker iterates over device identifiers or enumeration endpoints to harvest fleet-wide details, then uses that information to plan follow-on attacks against payment devices, accounts, or associated infrastructure.

No public proof-of-concept exploit is listed in the enriched CVE data. See the CISA ICS Advisory ICSA-26-237-04 and the CISA CSAF file for the coordinated technical details.

Detection Methods for CVE-2026-18965

Indicators of Compromise

High-volume or sequential requests to PayRange management API endpoints from a single source address or client identifier.
Requests to device-detail endpoints that reference device identifiers not associated with the calling account.
API responses returning verbose device records to unauthenticated sessions or to accounts outside the device's expected tenant.

Detection Strategies

Compare the calling principal against the tenant or owner of each requested device record and alert on cross-tenant reads.
Baseline normal per-account request volume to management endpoints and alert on statistical outliers indicating enumeration.
Inspect API gateway logs for anonymous or low-privilege sessions successfully retrieving device metadata that should require elevated roles.

Monitoring Recommendations

Forward PayRange API access logs, gateway logs, and WAF telemetry to a centralized analytics platform for correlation.
Track error-to-success ratios on device lookup endpoints, since low error rates during enumeration suggest missing authorization rather than brute force.
Alert on repeated GET requests against management routes with incrementing identifiers or wide fleet-wide queries.

How to Mitigate CVE-2026-18965

Immediate Actions Required

Apply the vendor guidance referenced in CISA ICSA-26-237-04 as soon as PayRange publishes updated API controls.
Restrict network exposure of PayRange management endpoints to trusted origins where feasible, using allowlists at the edge.
Rotate API tokens and review recent access logs for signs of large-scale device enumeration.

Patch Information

The enriched data does not list a specific patched version. Operators should track the CISA ICS Advisory ICSA-26-237-04 and the associated CSAF record for remediation details and any fixed release announced by PayRange.

Workarounds

Place the PayRange management API behind an authenticated reverse proxy or API gateway that enforces per-tenant authorization until the vendor fix is confirmed.
Add rate limiting and anomaly-based throttling to management endpoints to slow enumeration attempts.
Reduce the verbosity of any client-side integrations that expose device identifiers, limiting the attacker's ability to guess valid targets.

bash

# Example gateway rule concept: deny anonymous access and rate-limit device lookups
# (adapt to your API gateway or WAF syntax)
location /api/devices/ {
    # Require authenticated session
    if ($http_authorization = "") { return 401; }

    # Rate limit per client to slow enumeration
    limit_req zone=payrange_api burst=10 nodelay;

    proxy_pass https://payrange-backend.internal;
}