AUTHPOINT AUTHENTICATION GATEWAY · CVE-2026-121639 · Infrastructure
FIX → 7.6.0 ✓ verified
WatchGuard AuthPoint Gateway is missing an authentication check on a critical function. A remote attacker with network access to the gateway host can disrupt authentication services and delete the local directory synchronization configuration.
first public Nov 4, 2026 · 2 sources
Running AuthPoint Authentication Gateway? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organizations running the WatchGuard AuthPoint Gateway host on their network are exposed, since the flaw is reachable over the network without credentials. The sources do not list affected versions, so the exact exposure is unknown. Teams that do not run AuthPoint Gateway can skip it.
Not affected if gateway-version-7.6.0-or-later, no-authpoint-gateway
Who cares authpoint, ldap, mfa, on-prem, radius, watchguard
Upgrade to 7.6.0
Upgrade AuthPoint Gateway to 7.6.0 or later (released 29 October 2026; download from WatchGuard Cloud).
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-121639") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.