CISA Issues Advisory for Critical Missing Authorization Vulnerability in PayRange API

The Cybersecurity and Infrastructure Security Agency (CISA) has published industrial control systems advisory ICS-26-237-04, disclosing a critical missing authorization vulnerability in the PayRange API. The vulnerability, identified as CVE-2026-18965, affects PayRange API versions across all releases (vers:all/*).

According to the advisory, the affected product is missing proper authorization on management endpoints. This flaw allows a remote attacker, whether authenticated or unauthenticated, to disclose sensitive information, arbitrarily modify devices, cause a denial of service, or alter a device's displayed image. The vulnerability specifically enables verbose details of every device on the PayRange network to be publicly accessible.

The affected products span Critical Infrastructure Sector: Commercial Facilities, with deployments reported in the United States and Canada. PayRange, headquartered in the United States, has not responded to CISA's requests to work together on mitigation. Users seeking additional information are directed to contact PayRange customer support at support@payrange.com.

The vulnerability is tracked under CWE-862 (Missing Authorization). Two CVSS metric sets are provided: CVSS 3.1 Base Score 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 Base Score 8.7 (HIGH) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CISA notes that no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. The advisory was initially released on 2026-08-25. CISA recommends that organizations minimize network exposure for all control system devices and systems, ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is required, more secure methods such as Virtual Private Networks (VPNs) should be used, and organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures.