Vulnerability intelligence
CVE-2026-101891
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
CVSS Score
9.3
Critical
EPSS — Exploit Probability
—
Awaiting FIRST.org data · checked 2026-09-29
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Sep 29, 2026 · latest Sep 29, 2026
Coverage timeline
-
WatchGuard Access Points Expose Networks to Critical Command Injectionsecurityonline.info · Sep 29, 2026