Vulnerability · Published Sep 28, 2026 · Assigned by WatchGuard
CVE-2026-101891WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
Critical 9.3
In plain English
A critical-severity improper access control in WatchGuard AP from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | WatchGuard AP | 1.0 – before 3.4.8 |
Weakness: CWE-284, CWE-923 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://psirt.watchguard.com/CVE-2026-101891 vendor-advisory