The Cybersecurity and Infrastructure Security Agency on Aug. 25 warned that a missing-authorization flaw in the PayRange API could let a remote attacker disclose sensitive information, disrupt devices, or change the images they display. The vulnerability affects all listed versions of the PayRange API and carries a CVSS 3.1 score of 8.8, rated high.

Tracked as CVE-2026-18965, the flaw affects management endpoints that do not properly enforce authorization. CISA said verbose details for every device on the PayRange network may be publicly accessible with or without an account. The advisory classifies the weakness as CWE-862, or missing authorization.

The issue is listed in CISA’s Industrial Control Systems advisory database as a known-affected PayRange product vulnerability. The affected product entry identifies PayRange API versions as “all,” and lists deployments in the United States and Canada. CISA identifies the relevant critical-infrastructure sector as commercial facilities.

The exposure creates several potential consequences. An attacker could obtain sensitive device information, arbitrarily modify a device in a way that causes a denial-of-service condition, or alter an image displayed by the device, CISA said. The advisory describes the potential attacker as either authenticated or unauthenticated and says exploitation could be carried out remotely.

CISA’s CVSS 3.1 vector describes a network-based attack requiring low complexity, low privileges and no user interaction. It assigns high impact to confidentiality, integrity and availability. The advisory also records a CVSS 4.0 base score of 8.7, with a high severity rating.

CISA said PayRange had not responded to requests to work with the agency on mitigating the vulnerability. Users of PayRange devices were invited to contact PayRange customer support at [email protected] for additional information. Tahi Wilton Geary was credited with reporting the vulnerability to CISA.

The agency recommends minimizing network exposure for control-system devices and systems and ensuring that they are not accessible from the internet. It also advises organizations to place control-system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, CISA recommends using more secure methods such as virtual private networks. The agency cautions that VPNs can themselves contain vulnerabilities and should be updated to the most current version available. It also notes that a VPN is only as secure as the devices connected to it.

CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. The agency points users to its control-systems security recommendations and other cyber-defense guidance on its Industrial Control Systems website, including material on defense-in-depth strategies and targeted cyber-intrusion detection and mitigation.

Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation with other incidents. CISA separately advises users to avoid clicking links or opening attachments in unsolicited email messages as part of its recommendations for reducing social-engineering and phishing risks.

CISA said no known public exploitation specifically targeting CVE-2026-18965 had been reported at the time of the advisory’s publication.