CVE-2026-101891

WatchGuard access points have an improper access control flaw in an internal API service. An unauthenticated attacker who can reach the access point over the network can obtain a valid API session without credentials. CVSS 4.0 rates the impact on the access point itself as high for confidentiality, integrity, and availability, with no indicated impact on subsequent systems. The provided data does not name specific models or firmware versions. There is no known public proof of concept and the CVE is not in CISA KEV.

What to do: Restrict network access to WatchGuard access-point management and internal API interfaces to trusted administrative networks only until a vendor fix is applied. Check WatchGuard security advisories for the affected models and firmware, and install the published update as soon as it is available. Review AP logs for unexpected unauthenticated API sessions from untrusted hosts.