The Cybersecurity and Infrastructure Security Agency has warned that a missing-authorization vulnerability in PayRange API management endpoints could let a remote attacker access sensitive information, disrupt devices, or change their displayed images. The advisory assigns the flaw, tracked as CVE-2026-18965, a high CVSS v3.1 score of 8.8.
The affected product is listed as PayRange API, with all versions marked known affected. CISA says the management endpoints expose verbose details about every device on the PayRange network publicly, whether the requester has an account or not. The weakness is categorized as CWE-862, or missing authorization, a condition in which a system fails to properly verify whether a user or request is allowed to access a function or resource.
Successful exploitation could allow an attacker to disclose sensitive information, arbitrarily modify a device to cause a denial of service, or alter the image displayed by the device, the advisory says. The impacts described by CISA cover confidentiality, integrity and availability: information could be exposed, device behavior could be changed, and devices could be made unavailable. The advisory does not state that an attacker must first compromise a device on the PayRange network.
The vulnerability is network accessible and has low attack complexity, according to the CVSS v3.1 vector. It requires limited privileges but no user interaction. CISA also lists a CVSS v4.0 base score of 8.7, rated high. The two scores use different versions of the Common Vulnerability Scoring System but both indicate that the flaw could have serious consequences if exploited.
The advisory identifies commercial facilities as the relevant critical-infrastructure sector and lists deployment in the United States and Canada. It names PayRange as the vendor and places the company’s headquarters in the United States. Tahi Wilton Geary is credited with reporting the vulnerability to CISA.
PayRange has not responded to requests to work with CISA on mitigation, according to the advisory. Users of PayRange devices are directed to contact PayRange customer support at [email protected] for additional information. CISA’s notice does not identify a software update or other vendor-issued fix.
CISA recommends minimizing internet exposure for control-system devices and related systems. The agency advises organizations to place control-system networks and remote devices behind firewalls and isolate them from business networks. Those measures are intended to reduce the number of systems directly reachable from the internet and limit the potential spread of an intrusion between operational and business environments.
When remote access is necessary, CISA recommends using more secure methods such as virtual private networks and keeping those technologies updated. The agency also cautions that a VPN is only as secure as the devices connected to it. Organizations are advised to assess potential impacts and risks before deploying defensive measures, particularly where changes could affect the operation of connected devices.
CISA encourages organizations to apply broader cybersecurity strategies for proactive defense of industrial control systems and to consult its control-systems security guidance. The agency also advises organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation with other incidents.
CISA said no known public exploitation specifically targeting CVE-2026-18965 had been reported at the time of the advisory. The notice was initially published on Aug. 25, 2026.