CVE-2026-101891
CriticalCVSS 9.3Summary
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Risk Assessment
Obtaining an API session without authentication may allow an attacker to perform unauthorized operations on the access point, including configuration changes or exfiltration of sensitive data.
Recommendation
Apply WatchGuard updates for access points. Restrict network access to the internal API and enforce multi-factor authentication where possible.
Other vulnerabilities in WatchGuard AP
See all- CVE-2026-87969High
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
- CVE-2026-86102Critical
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Original NVD description (English source)
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS