CVE-2026-101891 - Vulnerability Details - OpenCVE

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Watchguard Subscribe	Watchguard Ap Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

WatchGuard AP 3.4.8

Workaround

No workaround given by the vendor.

References

Link	Providers
https://psirt.watchguard.com/CVE-2026-101891

History

Mon, 28 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Title		WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
First Time appeared		Watchguard Watchguard watchguard Ap
Weaknesses		CWE-284 CWE-923
CPEs		cpe:2.3:a:watchguard:watchguard_ap::::::::
Vendors & Products		Watchguard Watchguard watchguard Ap
References		https://psirt.watchguard.com/CVE-2026-101891
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2026-09-28T16:51:22.067Z

Updated: 2026-09-28T18:02:56.755Z

Reserved: 2026-09-28T15:53:24.081Z

Link: CVE-2026-101891

Vulnrichment

Updated: 2026-09-28T17:53:13.296Z

NVD

Status : Received

Published: 2026-09-28T17:17:48.677

Modified: 2026-09-28T18:17:17.600

Link: CVE-2026-101891

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101891", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-09-28T15:53:24.081Z", "datePublished": "2026-09-28T16:51:22.067Z", "dateUpdated": "2026-09-28T18:02:56.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-28T16:51:22.067Z"}, "title": "WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access", "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session."}], "affected": [{"vendor": "WatchGuard", "product": "WatchGuard AP", "versions": [{"status": "affected", "version": "1.0", "versionType": "semver", "lessThan": "3.4.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-101891", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:watchguard_ap:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "3.4.8"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284", "type": "CWE", "cweId": "CWE-284"}, {"lang": "en", "description": "CWE-923", "type": "CWE", "cweId": "CWE-923"}]}], "credits": [{"lang": "en", "value": "Discovered internally by WatchGuard", "type": "finder"}], "solutions": [{"lang": "en", "value": "WatchGuard AP 3.4.8", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard AP 3.4.8"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T17:20:19.372937Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T18:02:56.755Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101891", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-09-28T15:53:24.081Z", "datePublished": "2026-09-28T16:51:22.067Z", "dateUpdated": "2026-09-28T16:51:22.067Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-28T16:51:22.067Z"}, "title": "WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access", "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session."}], "affected": [{"vendor": "WatchGuard", "product": "WatchGuard AP", "versions": [{"status": "affected", "version": "1.0", "versionType": "semver", "lessThan": "3.4.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-101891", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:watchguard_ap:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "3.4.8"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284", "type": "CWE", "cweId": "CWE-284"}, {"lang": "en", "description": "CWE-923", "type": "CWE", "cweId": "CWE-923"}]}], "credits": [{"lang": "en", "value": "Discovered internally by WatchGuard", "type": "finder"}], "solutions": [{"lang": "en", "value": "WatchGuard AP 3.4.8", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard AP 3.4.8"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T17:20:19.372937Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-28T17:53:13.296Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WatchGuard AP", "vendor": "WatchGuard", "versions": [{"lessThan": "3.4.8", "status": "affected", "version": "1.0", "versionType": "semver"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session."}], "id": "CVE-2026-101891", "lastModified": "2026-09-28T18:17:17.600", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101891", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T17:20:19.372937Z", "version": "2.0.3"}}]}, "published": "2026-09-28T17:17:48.677", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "url": "https://psirt.watchguard.com/CVE-2026-101891"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-923"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}