Cisco and WatchGuard release patches; SonicWall leaves GMS unpatched
SonicWall will not patch two critical flaws in its end-of-life Global Management System.
60
Vulnerability1 · 1 read
CVE-2026-121638
Improper Certificate Validation in WatchGuard AuthPoint Gateway
- CVSS 4.0
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper Certificate Validation in WatchGuard AuthPoint Gateway allows on-path network attackers to intercept and modify communications between the gateway and local authentication providers. No authentication or user interaction required. Attackers can eavesdrop or alter authentication flows. WatchGuard AuthPoint Gateway users are affected.
What to do: No fixed version mentioned. Apply WatchGuard's update for CVE-2026-121638.
| Product | Affected |
|---|---|
| WatchGuard AuthPoint Gateway | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
- Weakness
- CWE-295
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesWatchGuard AuthPoint Gateway affected by four vulnerabilities
CVEs allow forged LDAP authentication, MITM attacks, unauthenticated DoS, and unauthorized admin actions prior to 7.6.0.
50