Critical severity · published Sep 28, 2026
CVE-2026-101891
WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WatchGuard AP · WatchGuard
1.0 before 3.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101891
vendor-advisory
https://psirt.watchguard.com/CVE-2026-101891
More from WatchGuard AP
9.3
CVE-2026-86102
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
8.6
CVE-2026-87969
WatchGuard AP Authenticated Command Injection in Diagnostic CLI