6 minhigh
PayRange API (CVE-2026-18965)
CISA published an ICS advisory for CVE-2026-18965, a missing authorization vulnerability (CWE-862) in all versions of the PayRange API. The flaw exposes management endpoints without proper access controls, allowing remote attackers to disclose sensitive information about every device on the PayRange network, modify device settings to cause denial of service, or alter displayed images. The CVSS v3.1 score is 8.8 (HIGH). PayRange has not responded to CISA coordination efforts, leaving no vendor-supplied patch available.
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2026-18965Missing authorization on management endpoints allows unauthenticated or authenticated remote attackers to access verbose device details, modify device configurations to cause denial of service, or alter displayed images.
Detection / Hunteropenrouter
What Happened
A security flaw was found in the PayRange API, a system used to manage PayRange devices deployed across the United States and Canada in commercial facilities. The flaw means that management controls are not properly protected, so a remote attacker could view detailed information about all devices on the network, change device settings to stop them from working, or alter what the devices display on their screens. The attacker does not necessarily need a valid account to do this. The vendor, PayRange, has not responded to CISA's attempts to coordinate a fix. Organizations using PayRange devices should contact PayRange support, restrict network access to these devices, and follow CISA's recommended defensive practices for industrial control systems.
Key Takeaways
- CVE-2026-18965 is a missing authorization vulnerability in PayRange API management endpoints affecting all versions.
- A remote attacker, authenticated or unauthenticated, can disclose sensitive device information, cause denial of service, or alter displayed images on PayRange devices.
- CVSS v3.1 base score is 8.8 (HIGH) with a vector indicating network-exploitable, low-complexity, low-privilege-required attack.
- PayRange has not responded to CISA requests to coordinate mitigation; no patch or vendor fix is currently available.
- No known public exploitation has been reported to CISA at the time of publication.
Affected Systems
- PayRange API (all versions)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-18965 | PayRange API | High | Missing authorization on management endpoints allows unauthenticated or authenticated remote attackers to access verbose device details, modify device configurations to cause denial of service, or alter displayed images. |
Attack Chain
- Initial Access: Attacker accesses PayRange API management endpoints over the network without requiring valid authorization credentials
- Discovery: Attacker retrieves verbose details of every device on the PayRange network
- Impact: Attacker modifies device configurations to cause denial of service or alters displayed images on devices
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory. The article is a CISA ICS vulnerability bulletin with no accompanying detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The vulnerability targets a network-accessible API for IoT payment devices. EDR agents are unlikely to be installed on PayRange hardware, so endpoint telemetry from the affected devices themselves is probably unavailable. |
| Network Visibility | Medium | If PayRange API traffic traverses monitored network segments, defenders may observe unauthenticated or anomalous requests to management endpoints. Visibility depends on whether PayRange communication is encrypted and whether the API endpoints are exposed to the internet or internal network. |
| Detection Difficulty | Hard | The vulnerability is a logic flaw in authorization rather than a known exploit payload. Detecting exploitation requires understanding which API calls should require authentication and flagging those that succeed without it. Without vendor documentation of the API structure, building accurate detection logic is difficult. |
Required Log Sources
- Network flow logs or firewall logs covering PayRange API endpoints
- Web application firewall (WAF) logs for PayRange management API paths
- API gateway or reverse proxy access logs
- Asset inventory for PayRange devices
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unauthenticated or low-privilege sessions accessing PayRange API management endpoints that return device inventory or configuration data. | WAF logs, reverse proxy access logs, or API gateway logs showing HTTP requests to PayRange management paths with successful 200 responses and no authentication headers. | Discovery / Collection | Medium — legitimate administrative tools or monitoring systems may access these endpoints with service accounts; verify whether the source is a known management station. |
| Consider hunting for HTTP requests to PayRange API endpoints that include modification parameters (PUT, POST, PATCH) originating from unauthenticated sessions or unexpected source IPs. | Web server or API gateway access logs showing state-changing HTTP methods against PayRange management endpoints from unauthenticated or anomalous sources. | Impact | Medium — authorized maintenance or configuration changes may generate similar traffic; correlate with change management records. |
Control Gaps
- Network-level access controls may not restrict access to PayRange API management endpoints if they are internet-facing
- Web application firewalls may not have rules to detect missing-authorization exploitation on API endpoints
- Asset inventories may not include PayRange devices, making it difficult to identify exposed systems
Key Behavioral Indicators
- HTTP requests to PayRange API management endpoints without authentication headers or tokens
- Successful HTTP 200 responses to device enumeration or configuration API calls from unauthenticated sessions
- State-changing HTTP methods (PUT, POST, PATCH) to PayRange management endpoints from unexpected source IP addresses
- Large-volume API responses containing device inventory data returned to unauthenticated clients
False Positive Assessment
Low — exploitation involves unauthenticated access to management endpoints that should require authorization; legitimate administrative access would typically use authenticated sessions, making unauthenticated management API calls inherently suspicious.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider identifying all PayRange devices and API endpoints in your environment and restricting network access to them via firewall rules or ACLs.
- If your network architecture supports it, consider isolating PayRange devices on a separate VLAN or network segment that is not accessible from the internet or general business networks.
- Consider contacting PayRange customer support at [email protected] to inquire about patch availability or vendor mitigations for CVE-2026-18965.
Infrastructure Hardening
- Evaluate whether PayRange API management endpoints need to be internet-accessible; if remote access is required, consider placing them behind a VPN or zero-trust network access solution.
- If you operate a web application firewall or API gateway in front of PayRange infrastructure, consider implementing rules to require authentication on management API paths and block unauthenticated state-changing requests.
- Consider implementing network-level monitoring or alerting for anomalous access patterns to PayRange API endpoints, such as unauthenticated requests returning device inventory data.
User Protection
- Consider educating facilities or operations staff who manage PayRange devices about the risk of unauthorized configuration changes and the importance of reporting unexpected device behavior.
- If PayRange devices display user-facing screens, consider monitoring for unauthorized image or content changes that could indicate exploitation.
Security Awareness
- Consider incorporating this advisory into existing ICS security awareness programs, emphasizing the importance of network segmentation for payment and IoT devices.
- If applicable to your awareness training, consider highlighting that vendor unresponsiveness to vulnerability coordination is a risk factor and that organizations should maintain their own compensating controls.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Initial Access
Tactic
Privilege Escalation
Tactic
