As cited
Copy frozen at (site build).
vulnerabilities
PayRange API
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PayRange API
CVE-2026-18965 affects PayRange application programming interface (API) across all versions, exposing missing authorization controls on management endpoints that allow unauthenticated access to verbose device details on the PayRange network. The vulnerability carries a CVSS score of 8.8 and could enable remote attackers to disclose sensitive information, modify devices, or cause denial of service. PayRange has not engaged with CISA on remediation, leaving users to contact vendor support directly.
Why it matters: Organizations operating PayRange devices in commercial facilities (particularly in the United States and Canada) face immediate exposure of network device details and potential operational disruption; practitioners should contact PayRange support and implement network segmentation to isolate control systems from internet access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PayRange API
The PayRange application programming interface (API) contains a missing authorization vulnerability (CVE-2026-18965) affecting all versions, allowing unauthenticated or authenticated attackers to access verbose device details on the PayRange network. Exploitation could lead to information disclosure, denial of service, or manipulation of device displays. PayRange has not engaged with CISA on mitigation, and users are directed to contact PayRange support for remediation.
Why it matters: Organizations operating PayRange devices in the United States and Canada face exposure of sensitive network information and device manipulation risk; practitioners should contact PayRange support immediately and implement network segmentation to isolate payment infrastructure from internet access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
PayRange API
The PayRange application programming interface (API) contains a missing authorization vulnerability (CVE-2026-18965) affecting all versions, allowing unauthenticated or authenticated attackers to access verbose device details on the PayRange network. Exploitation could lead to information disclosure, denial of service, or manipulation of device displays. PayRange has not engaged with CISA on mitigation, and users are directed to contact PayRange support for remediation.
Why it matters: Organizations operating PayRange devices in the United States and Canada face exposure of sensitive network information and device manipulation risk; practitioners should contact PayRange support immediately and implement network segmentation to isolate payment infrastructure from internet access.
- Source published
- First seen by Cybersecurity Tracker