Skip to content
Threat Feed
Subscribe
high advisory

WatchGuard AuthPoint Authentication Gateway multiple vulnerabilities (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640)

WatchGuard disclosed four vulnerabilities in AuthPoint Authentication Gateway versions prior to 7.6.0, including flaws enabling forged authentication, man-in-the-middle attacks, denial of service, and unauthorized administrative actions.

CVE search metadata

CVE search record: CVE-2026-121637. KEV: no. Product: AuthPoint Authentication Gateway (< 7.6.0). Brief: WatchGuard AuthPoint Authentication Gateway multiple vulnerabilities (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640). Brief link: https://feed.craftedsignal.io/briefs/2026-11-watchguard-authpoint-vulnerabilities/

CVE search record: CVE-2026-121638. KEV: no. Product: AuthPoint Authentication Gateway (< 7.6.0). Brief: WatchGuard AuthPoint Authentication Gateway multiple vulnerabilities (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640). Brief link: https://feed.craftedsignal.io/briefs/2026-11-watchguard-authpoint-vulnerabilities/

CVE search record: CVE-2026-121639. KEV: no. Product: AuthPoint Authentication Gateway (< 7.6.0). Brief: WatchGuard AuthPoint Authentication Gateway multiple vulnerabilities (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640). Brief link: https://feed.craftedsignal.io/briefs/2026-11-watchguard-authpoint-vulnerabilities/

CVE search record: CVE-2026-121640. KEV: no. Product: AuthPoint Authentication Gateway (< 7.6.0). Brief: WatchGuard AuthPoint Authentication Gateway multiple vulnerabilities (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640). Brief link: https://feed.craftedsignal.io/briefs/2026-11-watchguard-authpoint-vulnerabilities/

Triage facts

Revision 1
Applicability
AuthPoint Authentication Gateway (< 7.6.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
5 public sources
Freshness
Revision 1Nov 4, 22:03 UTC
Vulnerabilities
4 CVEs
Source quality
A1Likely

WatchGuard has released security advisories regarding multiple vulnerabilities affecting the AuthPoint Authentication Gateway. Versions prior to 7.6.0 are vulnerable to flaws that could allow attackers to forge authentication results, conduct man-in-the-middle attacks, trigger denial of service, or perform unauthorized administrative actions. As of November 4, 2026, administrators are advised to update to version 7.6.0 or later to mitigate these risks.

Impact

  • CVE-2026-121637: Potential authentication bypass or identity spoofing via HMAC validation failure in LDAP callbacks.
  • CVE-2026-121638: Man-in-the-middle (MitM) risk due to improper certificate validation.
  • CVE-2026-121639: Unauthenticated denial of service (DoS) via improper authentication handling.
  • CVE-2026-121640: Unauthorized administrative control possible through capture-replay of administrative traffic.

Recommendation

  • Upgrade all instances of AuthPoint Authentication Gateway to version 7.6.0 or later immediately.
  • Review administrative access logs for anomalous capture-replay signatures or unauthorized administrative configuration changes until patches are applied.
  • Restrict network access to the AuthPoint Authentication Gateway management interface to trusted administrative segments to reduce the attack surface for DoS and MitM vectors.

Threat Hunt

Monitor AuthPoint logs for anomalous administrative action patterns or unusual LDAP callback authentication results.

medium medium confidence hunt now

Data: AuthPoint management application logs, LDAP authentication logs

Mitigations

Upgrade AuthPoint Authentication Gateway to 7.6.0 or later

immediate IT Operations

CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640