CVE-2026-121639
CriticalCVSS 9.2Summary
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Risk Assessment
An attacker could remotely disrupt authentication services and delete directory synchronization configuration, potentially causing outages and loss of configuration data. Network access to the host is required.
Recommendation
Update WatchGuard AuthPoint Gateway to the latest version. Restrict network access to the AuthPoint Gateway host to trusted networks.
Other vulnerabilities in WatchGuard AuthPoint Gateway
See all- CVE-2026-121637High
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
- CVE-2026-121640Critical
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
- CVE-2026-121638Critical
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
- CVE-2026-95676High
A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.
Original NVD description (English source)
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS