By Homeland Threat Watch News Desk

The Cybersecurity and Infrastructure Security Agency has warned that a missing-authorization flaw in the PayRange API could let remote attackers expose sensitive information, disrupt devices, or change the images displayed on them. The advisory, published Aug. 25, identifies the issue as CVE-2026-18965 and lists all PayRange API versions as affected. CISA rated the vulnerability high severity, assigning it a CVSS version 3.1 score of 8.8.

The flaw affects management endpoints that do not properly enforce authorization. CISA said the weakness makes verbose details about every device on the PayRange network publicly accessible, whether a person has an account or not. The advisory classifies the issue under CWE-862, or missing authorization, and identifies the affected product as PayRange API from PayRange.

The affected product is listed as PayRange API, with the product version recorded as vers:all/* and its status marked known affected. CISA identifies commercial facilities as the relevant critical-infrastructure sector. The advisory lists the United States and Canada among the countries or areas where the product is deployed and identifies PayRange’s headquarters as being in the United States.

CISA said exploitation could be carried out by a remote attacker who is either authenticated or unauthenticated. The agency’s description indicates that an attacker could reach the affected functionality over a network. The CVSS 3.1 vector lists low attack complexity, a requirement for low privileges, and no user interaction. It also assigns high potential impact to confidentiality, integrity and availability.

Those impacts reflect several possible outcomes. An attacker could disclose sensitive information available through the affected management endpoints. The advisory also says an attacker could arbitrarily modify a device in a way that causes a denial of service. In addition, an attacker could alter an image displayed on a device. CISA’s summary describes these consequences as possible results of successful exploitation, rather than reporting a specific exploitation incident.

CISA said PayRange had not responded to requests to work with the agency on mitigation. The agency directed users of PayRange devices to contact PayRange customer support at [email protected] for additional information. The advisory lists no known public exploitation specifically targeting CVE-2026-18965 as of its publication.

CISA recommends minimizing internet exposure for control-system devices and related systems. The agency advises organizations to place control-system networks and remote devices behind firewalls and isolate them from business networks. These measures are intended to reduce the ability of an unauthorized remote party to reach exposed systems and management functions.

Where remote access is necessary, CISA recommends using more secure methods such as virtual private networks. The agency also cautions that VPNs can have vulnerabilities and should be updated to the most current version available. The security of a VPN connection also depends on the security of the devices connected to it, making the protection of those endpoints part of the defensive measures.

CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. The agency encourages organizations to implement cybersecurity strategies for proactive defense of industrial control-system assets and points users to additional control-systems security guidance on its ICS webpage.

Organizations that observe suspected malicious activity should follow their established internal procedures and report findings to CISA for tracking and correlation. CISA also recommends caution with unsolicited email, including avoiding links and attachments that could support social-engineering attacks. The advisory’s recommended practices are intended to reduce exposure while users assess affected PayRange deployments and seek additional information from the vendor.