CISA flags PayRange API flaw that could expose device data and disrupt displays

By Atlas Watchline Staff · Regulatory · August 25, 2026

CISA said a PayRange API vulnerability could let attackers view device details, change device behavior or alter a displayed image.

CISA on Aug. 25 issued an advisory on a PayRange API vulnerability that it said could let a remote attacker disclose sensitive information, change a device in ways that could cause a denial of service, or alter a device’s displayed image.

The agency said the issue affects all versions of PayRange API and rated it high severity. It identified the flaw as CVE-2026-18965 and said missing authorization on management endpoints could leave device details publicly accessible.

CISA said the issue involves management endpoints that lacked proper authorization. In its advisory, the agency said verbose details of every device on the PayRange network could be publicly accessible, with or without an account. CISA listed the weakness as CWE-862, or Missing Authorization.

The agency gave the issue a CVSS 3.1 base score of 8.8, rated HIGH, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It also listed a CVSS 4.0 base score of 8.7, also rated HIGH, with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CISA identified PayRange as the vendor and said the product status is known_affected. The advisory lists the critical infrastructure sector as Commercial Facilities and deployment areas as the United States and Canada. It also says the company headquarters location is in the United States.

The advisory says no known public exploitation specifically targeting the vulnerability has been reported to CISA so far. It also says PayRange has not responded to requests to work with CISA to mitigate the issue.

CISA acknowledged Tahi Wilton Geary as the reporter. The agency directed users to contact support@payrange.com for additional information.

CISA included standard defensive guidance in the advisory, including minimizing network exposure, placing control system networks behind firewalls, and using VPNs with updated versions when remote access is required.

Sources

• CISA Cybersecurity Advisories: PayRange API

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.