AUTHPOINT GATEWAY · CVE-2026-121638 · Infrastructure
FIX → 7.6.0 ✓ verified
WatchGuard AuthPoint Gateway does not properly validate certificates when talking to local authentication providers. An attacker on the network path can intercept and modify that traffic.
first public Nov 4, 2026 · 2 sources
Running AuthPoint Gateway? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running the self-installed WatchGuard AuthPoint Gateway (the Windows Server application that serves RADIUS, ADFS and LDAP for AuthPoint MFA) on a version below 7.6.0. Per the vendor listing, a network attacker can intercept the Gateway's connections because certificates are not properly validated. Teams not running the Gateway can skip it.
Not affected if no-authpoint-gateway
Who cares authentication, authpoint, mfa, mitm, self-hosted, watchguard, windows
7.6.0 is affectedUpgrade to 7.6.0
Upgrade AuthPoint Gateway to or later (released 29 Oct 2026).
7.6.0An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
This page as .md · .json · in your agent: get_signal("CVE-2026-121638") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.