PayRange Authorization Flaw in API: Remote Access to Payment Devices

On August 25, 2026, CISA published an advisory (ICSA-26-237-04) describing a missing authorization vulnerability in the PayRange API. Tracked as CVE-2026-18965, the flaw affects all versions of the product and allows a remote attacker to access sensitive data, arbitrarily modify devices, and cause service disruptions.

An Authorization Flaw

The vulnerability is classified as CWE-862, Missing Authorization. The issue lies in the API's management endpoints: they do not require proper authorization. As a result, anyone can obtain detailed information about every device on the PayRange network, whether they have an account or not.

According to the advisory, successful exploitation allows a remote attacker — authenticated or unauthenticated — to:

• disclose sensitive information;
• arbitrarily modify a device, causing a denial of service;
• alter the image displayed by the device itself.

The CVSS scores confirm the severity. In version 3.1, the vulnerability receives a base score of 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In version 4.0, the score drops slightly to 8.7 (HIGH) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. In both cases, the attack is possible from the network, requires low complexity, and no user interaction. The vector indicates low privileges (PR:L), but the advisory specifies that access to device details is possible even without an account: the critical point is the absence of authorization controls on the management endpoints.

Products and Distribution

The vendor is PayRange, headquartered in the United States. The affected product is PayRange API, listed as affected for all versions (vers:all/*). The status is known_affected: no patched versions exist at the time of advisory publication.

The distribution affects the United States and Canada. The reference critical infrastructure sector is Commercial Facilities, which includes commercial facilities and public services.

What an Attacker Can Do

The potential impact affects confidentiality, integrity, and availability. Unauthorized access to management endpoints exposes sensitive details about the entire PayRange device network. An attacker can map active devices, read their configurations, and then intervene directly.

Arbitrarily modifying a device can cause a denial of service: a payment fails, a vending machine stops responding, a self-service system remains blocked. Altering the displayed image also opens the door to fraudulent messages or unauthorized content shown on the device screen, with possible consequences for end users and the merchant's reputation.

At the time of advisory publication, CISA has not reported any known public exploitation specifically targeting CVE-2026-18965. The flaw is not included in CISA's KEV (Known Exploited Vulnerabilities) catalog, which collects actively exploited vulnerabilities.

No Patch: Recommended Countermeasures

The advisory does not mention a software fix. Users of PayRange API must therefore adopt defensive measures to reduce risk. CISA recommends:

• minimize network exposure of all control system devices and systems, preventing them from being accessible from the Internet;
• place control networks and remote devices behind firewalls, isolating them from business networks;
• when remote access is needed, use more secure methods such as VPNs, updated to the latest available version, and be aware that a VPN is only as secure as the devices to which it is connected;
• perform an impact analysis and risk assessment before applying any countermeasure.

CISA also refers to guidelines for industrial control systems published on cisa.gov/ics, including the document Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies and the technical information paper ICS-TIP-12-146-01B for detecting and mitigating targeted intrusions. Finally, it recommends protecting against social engineering attacks by not clicking web links and not opening attachments in unsolicited emails.

The Report

The vulnerability was reported to CISA by Tahi Wilton Geary. The advisory was released in initial revision on August 25, 2026. No information was provided about an earlier discovery date or any coordination with the vendor for a future patch.