WatchGuard AuthPoint Gateway affected by four vulnerabilities
Original title: WatchGuard security advisory (AV26-1125)
CVEs allow forged LDAP authentication, MITM attacks, unauthenticated DoS, and unauthorized admin actions prior to 7.6.0.
The Canadian Centre for Cyber Security reports vulnerabilities in WatchGuard AuthPoint Authentication Gateway. CVE-2026-121637 involves improper HMAC validation in LDAP authentication callback allowing forged results. CVE-2026-121638 involves improper certificate validation allowing MITM attacks. CVE-2026-121639 involves improper authentication allowing unauthenticated DoS. CVE-2026-121640 involves capture-replay allowing unauthorized admin actions. Updates are encouraged.
- CVE-2026-121637: Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
- CVE-2026-121638: Improper Certificate Validation Allows Man-in-the-Middle Attacks
- CVE-2026-121639: Improper Authentication Allows Unauthenticated Denial of Service
- CVE-2026-121640: Capture-replay Allows Unauthorized Administrative Actions
Impact: forged authentication results, MITM attacks, DoS, and unauthorized admin actions
| Product | Affected |
|---|---|
| WatchGuard AuthPoint Authentication Gateway | Prior to 7.6.0 |
- 1.Upgrade to 7.6.0
- Vendors
- WatchGuard
- Products
- AuthPoint Authentication Gateway
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-121639+3 related CVEs | Missing Authentication for Critical Function in WatchGuard AuthPoint Gateway | 9.2 group max | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1125 Date: November 4, 2026 As of November 4, 2026, WatchGuard is affected by vulnerabilities in the following product: AuthPoint Authentication Gateway Prior to 7. 6. 0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.