Description
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Published: 2026-09-28
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated API session acquisition granting privileged control over WatchGuard Access Points
Action: Patch immediately
AI Analysis

Impact

An internal API service on WatchGuard Access Points suffers an improper access control flaw that lets an attacker who can reach the device on the network acquire a valid API session without authentication. With the session token the attacker can issue any API calls that are normally restricted to administrators, effectively gaining full control of the device and potentially building a foothold into the surrounding network. This vulnerability is classified under CWE-284 and CWE-923.

Affected Systems

The flaw affects all versions of the WatchGuard AP product before version 3.4.8. The vendor has released WatchGuard AP 3.4.8 as the fix. Devices running earlier firmware are vulnerable.

Risk and Exploitability

The CVSS score of 9.3 marks this as a critical issue. No EPSS score is available, but the lack of external listing in the CISA KEV catalog does not diminish the local network nature of the attack. An attacker must have network connectivity to the AP to trigger the vulnerability, but once they obtain a session they can perform any privileged operation.

Generated by OpenCVE AI on September 28, 2026 at 18:44 UTC.

Remediation

Vendor Solution

WatchGuard AP 3.4.8

OpenCVE Recommended Actions

  • Apply the WatchGuard AP 3.4.8 firmware update or later to eliminate the vulnerability
  • Restrict network access to the API service by placing the Access Point in a dedicated administrative VLAN and limiting inbound traffic to trusted management hosts
  • If an immediate update is not possible, disable the internal API service or block its port on the firewalls guarding the device

Generated by OpenCVE AI on September 28, 2026 at 18:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Title WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
First Time appeared Watchguard
Watchguard watchguard Ap
Weaknesses CWE-284
CWE-923
CPEs cpe:2.3:a:watchguard:watchguard_ap:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard watchguard Ap
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Watchguard Ap
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-09-28T18:02:56.755Z

Reserved: 2026-09-28T15:53:24.081Z

Link: CVE-2026-101891

cve-icon Vulnrichment

Updated: 2026-09-28T17:53:13.296Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T17:17:48.677

Modified: 2026-09-28T20:51:05.473

Link: CVE-2026-101891

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T13:20:48Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-923

    Improper Restriction of Communication Channel to Intended Endpoints