CVE-2026-101891
Received Received - Intake

Improper Access Control in WatchGuard Access Points

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: WatchGuard Technologies, Inc.

Description
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101891
EUVD
EUVD-2026-88362

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
watchguard access_points *
watchguard access_points to 3.4.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper access control flaw in an internal API service on WatchGuard Access Points (AP) running versions below 3.4.8. An unauthenticated attacker with network access to the AP can obtain a valid API session, bypassing authentication.

Detection Guidance

To detect this vulnerability, check if WatchGuard Access Points are running versions below 3.4.8. Use commands like 'show version' on the AP CLI or check the web interface for the firmware version. Monitor network traffic for unauthorized API session requests to internal services.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the API, potentially allowing them to manipulate the AP or extract sensitive data. This could lead to further network compromise or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected WatchGuard APs may face compliance violations and potential fines.

Mitigation Strategies

Update WatchGuard Access Points to version 3.4.8 or later to resolve the vulnerability. Monitor network traffic for unauthorized API session attempts and restrict network access to the AP management interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart