CVE-2026-18965

The PayRange API fails to enforce authorization (CWE-862) on its management endpoints, so verbose details for every device connected to the PayRange network are publicly accessible to anyone, whether or not they hold a PayRange account. The flaw is triggered simply by requesting device information from these network-accessible endpoints, with no special privileges or user interaction required. An attacker gains detailed, fleet-wide visibility into PayRange device records, an information-disclosure impact scored 8.7 (High) under CVSS 4.0. Operators whose machines use PayRange payment technology (unattended retail, laundry, and similar deployments) are affected because their device details are exposed. As of this analysis there is no known exploitation, no public proof-of-concept, EPSS is 0.4% (37th percentile), and the issue is not listed in CISA KEV.

What to do: Contact PayRange for patched API/firmware guidance and apply updates as soon as available, since no fixed version is specified in the current data. Monitor for the associated CISA ICS advisory (assigned by [email protected]) for confirmed remediation details, and in the meantime review what device information your fleet's records contain to gauge the sensitivity of the exposure.