Do Son 
TL;DR
WatchGuard released urgent updates for WatchGuard AuthPoint Gateway to fix three critical flaws and one high-risk bug. Consequently, attackers could stop login services, intercept traffic, or fake user sessions. Network teams must update to version 7.6.0 now to block these attacks.
- Product: WatchGuard AuthPoint Authentication Gateway
- Vulnerabilities: 4 flaws (CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service
- Status: No confirmed exploitation yet; patches available
- Action: Update to 7.6.0 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-121639 | 9.2 | AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service | 7.6.0 | Not exploited |
| CVE-2026-121638 | 9.1 | AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks | 7.6.0 | Not exploited |
| CVE-2026-121640 | 9.1 | AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions | 7.6.0 | Not exploited |
| CVE-2026-121637 | 8.9 | AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results | 7.6.0 | Not exploited |
Why It Matters
WatchGuard AuthPoint Gateway links local user lists to cloud login services. Therefore, flaws in this tool put company access controls at high risk. WatchGuard AI Security Research found all four bugs during internal tests. Furthermore, both the WatchGuard PSIRT advisories and the MITRE CVE database confirm the severe impact of these flaws. Currently, WatchGuard states that no active attacks in the wild or public exploit tools exist. Although exact install counts remain private, thousands of firms use AuthPoint for daily login safety.
How the Attack Works
Service Disruption and Replay Attacks
First, CVE-2026-121639 (CVSS 9.2) stems from missing auth checks on a key function (CWE-306). As a result, a remote attacker with network access can stop login services. In addition, the attacker can delete local folder sync settings. Similarly, CVE-2026-121640 (CVSS 9.1) is a capture-replay flaw (CWE-294). An attacker who sees a valid request between gateway parts can replay it. Thus, they can run rogue admin tasks and halt login services.
Traffic Interception and Session Forgery
Next, CVE-2026-121638 (CVSS 9.1) involves weak cert checks (CWE-295). Consequently, an on-path attacker can intercept and change traffic between the gateway and local login servers. Finally, CVE-2026-121637 (CVSS 8.9) stems from flawed HMAC checks in the LDAP callback (CWE-345). If a network attacker gets a valid header signature, they can fake the login result. They can also forge session IDs in the request body to gain rogue access.
Affected Versions
These four bugs affect all WatchGuard AuthPoint Gateway versions from 1.0 before 7.6.0. Specifically, CVE-2026-121637 affects LDAP setups, while CVE-2026-121639 hits LDAP and Active Directory systems. Moreover, CVE-2026-121638 impacts gateways linked to RADIUS, LDAP, or ADFS servers.
Patch and Mitigation Steps
WatchGuard fixed all four flaws in WatchGuard AuthPoint Gateway version 7.6.0. Therefore, admins should install version 7.6.0 right away through the WatchGuard Cloud portal. Meanwhile, security teams should limit network access to the gateway host and check logs for odd changes.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
