Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-101891

WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 3.4.8
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

Affected versions

  • WatchGuard WatchGuard AP

    From 1.0 · fixed in 3.4.8

References 1

psirt.watchguard.com