{"id":"CVE-2026-121639","kind":"vulnerability","aliases":["CVE-2026-121639"],"related":[],"title":"WatchGuard AuthPoint Gateway before 7.6.0: unauthenticated attacker can disrupt logins and delete sync config","description":"A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.","summary":"WatchGuard AuthPoint Gateway is missing an authentication check on a critical function. A remote attacker with network access to the gateway host can disrupt authentication services and delete the local directory synchronization configuration.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AuthPoint Authentication Gateway","fixed":["7.6.0"],"affected":">= 1.0, < 7.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authpoint","infrastructure","ldap","mfa","on-prem","radius","watchguard"],"not_affected_if":["gateway-version-7.6.0-or-later","no-authpoint-gateway"],"how_to_check":"- Find every AuthPoint Gateway install (RADIUS/LDAP sync host) and check its version; anything below 7.6.0 is affected.\n- Check whether the gateway host is reachable from networks you do not trust; restrict it to the networks that need it until you upgrade (general hardening, not a WatchGuard-stated workaround).\n- Teams without an on-prem AuthPoint Gateway can skip this.","fix":"Upgrade AuthPoint Gateway to 7.6.0 or later (released 29 October 2026; download from WatchGuard Cloud).","status":"open","published_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","triaged_at":"2026-11-04T15:28:18+00:00","updated_at":"2026-11-04T15:30:02+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-04T15:28:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WatchGuard AuthPoint Gateway: unauthenticated attacker can disrupt logins and delete sync config","impact":"medium","summary":"WatchGuard AuthPoint Gateway is missing an authentication check on a critical function. A remote attacker with network access to the gateway host can disrupt authentication services and delete the local directory synchronization configuration.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["watchguard","authpoint","mfa","on-prem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Authentication services disrupted and directory sync configuration deleted remotely","analyst_note":"Find the affected and fixed AuthPoint Gateway versions and any vendor advisory in the NVD entry or WatchGuard's security notices.","how_to_check":"- Confirm whether the AuthPoint Gateway is deployed in your environment and note its host address.\n- Check the installed AuthPoint Gateway version against the product ranges in the NVD entry (unknown in the sources).\n- Check whether the gateway host is reachable from networks an attacker could use (unknown in the sources).","plain_action":"","needs_analyst":true,"not_affected_if":["no-authpoint-gateway"],"who_is_affected":"Organizations running the WatchGuard AuthPoint Gateway host on their network are exposed, since the flaw is reachable over the network without credentials. The sources do not list affected versions, so the exact exposure is unknown. Teams that do not run AuthPoint Gateway can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000711,"input_tokens":4120,"output_tokens":598,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed AuthPoint Gateway versions and any vendor advisory in the NVD entry or WatchGuard's security notices.","search":"'-121639':17A,20A '-2026':16A,19A '7.6.0':5A 'access':50B,84C 'allow':77C 'attack':7A,47B,81C 'authent':39B,57B,68C,92C 'authentication':22A 'authpoint':2A,21A,24B,34B,75C,87C 'check':40B 'config':14A 'configur':65B,100C 'critic':43B,70C 'cve':15A,18A 'delet':12A,60B,95C 'directori':63B,98C 'disrupt':9A,56B,91C 'function':44B,71C 'gateway':3A,23A,35B,53B,76C,88C 'host':54B,89C 'infrastructur':25B 'ldap':26B 'local':62B,97C 'login':10A 'mfa':27B 'miss':37B,67C 'network':49B,83C 'on-prem':28B 'prem':30B 'radius':31B 'remot':46B,79C 'servic':58B,93C 'sync':13A 'synchron':64B,99C 'unauthent':6A,80C 'vulner':72C 'watchguard':1A,32B,33B,74C","nicknames":[],"mitigations":[],"who_affected":"Organizations running the WatchGuard AuthPoint Gateway host on their network are exposed, since the flaw is reachable over the network without credentials. The sources do not list affected versions, so the exact exposure is unknown. Teams that do not run AuthPoint Gateway can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T15:30:03Z","by":"analyst","doc":"https://www.watchguard.com/support/release-notes/Cloud/Content/en-US/AuthPoint/agent_releases.html","run_id":1676},"products":{"at":"2026-11-04T15:30:03Z","by":"analyst","doc":"https://www.watchguard.com/support/release-notes/Cloud/Content/en-US/AuthPoint/agent_releases.html","run_id":1676}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["authenticationgateway","authpointauthenticationgateway"],"ptokens":["authentication","authpoint","gateway"],"labels":["authpoint","critical","infrastructure","ldap","mfa","onprem","radius","watchguard"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121639","severity":null,"published_at":"2026-11-04T15:17:42+00:00","modified_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","fetched_at":"2026-11-04T15:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121639:1676","url":null,"severity":null,"published_at":"2026-11-04T15:30:02+00:00","modified_at":"2026-11-04T15:30:02+00:00","first_seen_at":"2026-11-04T15:30:02+00:00","fetched_at":"2026-11-04T15:30:02+00:00","note":"WatchGuard PSIRT listing (2026-11-04): AuthPoint Authentication Gateway >=1.0,<7.6.0 affected, 7.6.0 fixed, CVSS 4.0 9.2. Per-CVE page not found, so impact details rest on NVD text. 7.6.0 released 29 Oct 2026 per release notes. No exploitation or PoC found; no mitigations listed."}],"documents":[{"id":6985,"url":"https://psirt.watchguard.com/","title":"WatchGuard Security Advisories (PSIRT listing)","kind":"advisory","source":"analyst","publisher":null,"text":"WatchGuard PSIRT index row (psirt.watchguard.com, fetched 2026-10-27):\nSeverity 7.2 | CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | Affected: Default >= 2025.1, < 2026.4; >= 12.0, < 12.12.4. T15/T35 >= 12.0, < 12.5.22. Fixed: >= 2026.4, >= 12.12.4; T15/T35 >= 12.5.22 | Published 2026-10-27\n","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":67996,"url":"https://www.watchguard.com/support/release-notes/Cloud/Content/en-US/AuthPoint/agent_releases.html","title":"AuthPoint Gateway releases (v7.6.0, 29 Oct 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}