CVE-2026-101891

Think of this like a side door on a security camera system that opens for anyone who walks up to it, no key needed. Someone connected to the same network as your WatchGuard Access Point could walk through that door and take control of the device without ever proving who they are.

This matters to you if you run WatchGuard Access Points for your office or guest Wi-Fi. It affects the device in its normal, default configuration — no special settings need to be enabled for the problem to exist — so the only real protection until you patch is limiting who can reach the AP's network segment.

This is a high-severity, trivially exploitable flaw: any attacker who can reach the access point over the network can take it over instantly, with no password and no user interaction required. There is no evidence yet of attackers actively exploiting this in the wild, but because exploitation requires no skill or special access, you should treat this as urgent and patch now rather than wait for confirmed attacks.

Confirm exposure by checking the firmware version on all deployed WatchGuard AP units; any version prior to 3.4.8 is vulnerable to unauthenticated API session creation via the improper access control flaw (CWE-284/CWE-923). Upgrade all affected units to firmware 3.4.8, which closes the access-control gap in the internal API service. There is no indication of a breaking-change upgrade path issue reported. As a temporary workaround while scheduling the update, restrict management-plane network access to the AP (e.g., via VLAN segmentation or ACLs) so only trusted admin hosts can reach the API service — this device is reachable in its default configuration, so network isolation is the only interim mitigation. This CVE is not currently in CISA's KEV catalog and has no confirmed exploitation or public exploit code, so there is no CISA remediation deadline; however, monitor WatchGuard advisories and threat intelligence for any change in exploitation status given the sustained press attention around this disclosure.

CWE-284 (Improper Access Control) and CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) combine to allow an unauthenticated, network-based attacker to obtain a valid API session token with no user interaction, affecting the device's default configuration. Exploit maturity is low — no public proof-of-concept exploit code exists, and no dated news or KEV entry confirms active exploitation. EPSS scores this as low predicted likelihood (18th percentile) with a flat trend, though the ease of exploitation (unauthenticated, network-reachable, no preconditions beyond connectivity) makes this a high-impact finding despite the low predicted-exploitation score. The vendor has released a fix in version 3.4.8.