Multiple Vulnerabilities in WatchGuard's AuthPoint Gateway
WatchGuard AI Security Research has reported multiple vulnerabilities in AuthPoint Gateway affecting AuthPoint Authentication Gateway in versions from 1.0 up to but not including 7.6.0. These vulnerabilities allow for authentication disruption, interception and modification of communications with local authentication providers, or unauthorized administrative actions.
Overview of Detected Vulnerabilities
Three critical vulnerabilities have been identified:
- CVE-2026-121639: affects installations configured with an LDAP or Active Directory provider. The lack of authentication in a critical function allows an unauthenticated remote attacker with network access to disrupt authentication services and remove local directory synchronization settings.
- CVE-2026-121638: affects installations configured with a RADIUS, LDAP, or ADFS resource. Incorrect certificate validation allows an attacker positioned in the communication path to intercept and modify traffic between AuthPoint Gateway and local authentication providers.
- CVE-2026-121640: allows the reuse of a legitimate request captured between AuthPoint Gateway components to bypass authentication and perform unauthorized administrative actions, including disrupting authentication services.
Severity and Exploitation
The vulnerabilities presented are rated as critical. At the time of publication, no active exploitation of these vulnerabilities has been reported.
Available Solution
WatchGuard has released an update that addresses these vulnerabilities. The solution involves upgrading AuthPoint Authentication Gateway to version 7.6.0.
Official Information and Context
The National Cybersecurity Institute (INCIBE-CERT) published this alert on November 5, 2026, with identifier INCIBE-2026-840, based on the notice issued by WatchGuard AI Security Research. The bulletin highlights the existence of these vulnerabilities and the availability of the update that fixes them.
Additional Technical Details on AuthPoint Gateway Vulnerabilities
The vulnerabilities detected in AuthPoint Gateway affect critical functions of the authentication system, which can compromise the security of communications and administrative management. In particular, the flaw identified as CVE-2026-121639 is due to the absence of an authentication mechanism in a specific function, allowing a remote attacker with network access to disrupt services and remove essential synchronization settings with local directories such as LDAP or Active Directory.
On the other hand, the CVE-2026-121638 vulnerability is related to incorrect validation of digital certificates. This deficiency enables an attacker positioned in the communication path to intercept and modify traffic between AuthPoint Gateway and local authentication providers, such as RADIUS, LDAP, or ADFS, compromising the integrity and confidentiality of transmitted data.
Finally, the CVE-2026-121640 vulnerability allows the reuse of previously captured legitimate requests within AuthPoint Gateway components. This capture and replay technique enables an attacker to bypass authentication controls and perform unauthorized administrative actions, including disrupting authentication services, which poses a critical risk to system availability.
Security and Management Implications for AuthPoint Gateway
These vulnerabilities in AuthPoint Gateway highlight the need for rigorous management of configurations and communications in multifactor authentication systems. The potential to disrupt services, modify communications, or execute unauthorized administrative actions can severely impact the security of infrastructures that rely on this system to control access and protect critical resources.
Upgrading to version 7.6.0 of AuthPoint Authentication Gateway is the technical measure that addresses these flaws, reinforcing authentication mechanisms, certificate validation, and request management. Keeping systems updated is essential to prevent these vulnerabilities from being exploited and to ensure the continuity and security of authentication services.
For more information, visit the original source.
Published: 11/11/2026.
This article may have been prepared with the assistance of artificial intelligence tools. View AI policy
You can support the project or share this article in one click. At least this block does something useful.