WatchGuard published four AuthPoint Gateway advisories on 4 November 2026, CVE-2026-121637 to CVE-2026-121640. All four affect AuthPoint Authentication Gateway from 1.0 up to but not including 7.6.0, and 7.6.0 fixes them. WatchGuard rates them 8.9 to 9.2 on CVSS 4.0 and says it is not aware of exploitation in the wild.
WatchGuard’s advisories describe the Gateway as exchanging traffic with your local authentication providers and between its own components, so these flaws touch authentication results and directory synchronization. The table puts the four side by side, because they differ in what an attacker needs and in which Gateway configuration is exposed.
| CVE | Weakness | Attacker needs | What it allows | CVSS 4.0 | Configuration named |
|---|---|---|---|---|---|
| CVE-2026-121637 | CWE-345 | A valid header signature and network access | Forge the authentication result and transaction identifier in the LDAP callback | 8.9 High | LDAP provider |
| CVE-2026-121638 | CWE-295 | An on-path network position | Intercept and modify traffic between the Gateway and local authentication providers | 9.1 Critical | RADIUS, LDAP or ADFS resource |
| CVE-2026-121639 | CWE-252, CWE-287, CWE-306 | Network access to the Gateway host, no authentication | Disrupt authentication services and delete the local directory synchronization configuration | 9.2 Critical | LDAP or Active Directory provider |
| CVE-2026-121640 | CWE-294 | A legitimate request observed between Gateway components | Replay it to take administrative actions, including disrupting authentication | 9.1 Critical | None named on the advisory page |
How Do You Read This Table?
Start with the third column. Only CVE-2026-121639 is reachable by a remote attacker with no credentials and no captured item. The other three need a position or a captured item: a header signature, an on-path seat or a recorded request.
CVSS 4.0 records this as attack requirements. The vectors for 121637, 121638 and 121640 carry AT:P, present, while 121639 carries AT:N, none. WatchGuard is the CNA and publishes CVSS 4.0 only. The records and NVD hold no CVSS 3.1 score, and NVD had not yet analysed any of them on 4 November 2026.
What Does Each Row Mean for a Defender?
CVE-2026-121637: a forged LDAP callback result
The record says an attacker holding a valid header signature can change the authentication result and the transaction identifier in the request body. The advisory title calls it improper HMAC validation, and our reading is that the signature does not cover the body. How an attacker would obtain such a signature is not stated.
CVE-2026-121638: certificates not validated
The Gateway does not properly validate certificates when it talks to local authentication providers, so an on-path attacker can read and alter the exchange. The vector rates confidentiality and integrity impact high. We would expect credentials to travel on that path, but the advisory does not say so.
CVE-2026-121639: the one a stranger can reach
No authentication is needed to disrupt authentication services and delete the directory synchronization configuration. Its vector sets attack requirements and privileges to none, which fits the highest score, 9.2. The impact is on availability, so the question is what your login policy does when the Gateway is down.
CVE-2026-121640: a replayable request
A request seen between Gateway components can be sent again to perform administrative actions. The advisory names no configuration requirement beyond that. Treat every Gateway as exposed until it runs 7.6.0.
What Do WatchGuard, CISA and NVD Say About Exploitation?
- Exploitation in the wildNot seenWatchGuard says it is not aware of any exploitation of these flaws4 Nov 2026
- Listed in CISA KEVNot seenNone of the four is in catalogue version 2026.11.044 Nov 2026
- Exploitation, CISA SSVC entriesNot seenThe CISA Coordinator entries list exploitation as none for all four4 Nov 2026
- Automatable, CVE-2026-121639YesCISA marks only this one as automatable; the other three as not4 Nov 2026
- Fixed versionYesAuthPoint Authentication Gateway 7.6.04 Nov 2026
WatchGuard’s AuthPoint release notes list Gateway 7.6.0 under 29 October 2026 and describe it as EAP-MSCHAPv2 support for RADIUS, duplicate request handling and minor fixes. The same entry lists “Resolved a security vulnerability” under ticket AAAS-32917 with no CVE id, so the notes do not say which of the four it covers. If you update on a routine cycle you may already run 7.6.0, so check the version instead of assuming.
How Do You Fix and Check Your Gateways?
WatchGuard names the update. The other steps are our advice, ordered by how much risk each one removes for the time it takes.
- Find every GatewayInclude ones an MSP or an old project installed, and note version and host.
- Update to 7.6.0 or laterRead WatchGuard’s release notes first: a 2 July 2026 entry says the Gateway requires Corretto 17 or higher, or JDK 17 or higher.
- Limit who reaches the hostAllow only AuthPoint and admin sources to the Gateway ports, which narrows CVE-2026-121639.
- Protect the path to your directoryKeep Gateway traffic to LDAP, RADIUS and ADFS on a segment you control, which narrows the on-path flaws.
- Watch for symptomsAlert on Gateway restarts, failed directory syncs and sudden authentication failures.
- Write the outage ruleDecide what users do when the Gateway is down, so an outage is not a lock-out or a bypass.
Our entries on network segmentation and multi-factor authentication cover the controls behind steps 3 and 4. For RADIUS exchanges on the wire, see our article on the BlastRADIUS flaw in the RADIUS protocol. The technique page on valid accounts shows what a forged or replayed authentication leads to.
What Would Change This Picture?
A CISA KEV listing, a WatchGuard note that attacks have begun, or NVD analysis that changes the scores would raise the priority. We will update this post if any of them appears. Until then, the order is inventory, update and narrow reach.