// CVE · PUBLISHED 2026-09-28
CVE-2026-101891 WatchGuard / WatchGuard AP
9.3 · CVSS 4.0 Critical
Description An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.
Details Products WatchGuard / WatchGuard AP Published 28 Sept 2026 Modified 28 Sept 2026 CVSS 9.3 Critical (v4.0) Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Score source CNA CWE CWE-284 , CWE-923 Record status Deferred