CVE-2026-121638

psirt.watchguard.com • November 6, 2026

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.

Required Configuration for Exposure #

This vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource.

Weakness Type and Impact #

CWE CWE-295 Improper Certificate Validation

CAPEC CAPEC-94 Adversary in the Middle (AiTM)

Exploitation Status #

WatchGuard AI Security Research finder

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard AuthPoint Gateway Require Immediate Attention WatchGuard has disclosed four critical vulnerabilities in its AuthPoint Authentication Gateway, affecting versions 1.0 to below 7.6.0. The vulnerabilities include CVE-2026-121637 (8.9), CVE-2026-121638 (9.1), CVE-2026-121639 (9.2), and CVE-2026-121640 (9.1). CVE-2026-121637 allows unauthorized session outcomes through improper HMAC validation in LDAP authentication. CVE-2026-121638 enables a Man-in-the-Middle attack due to improper certificate validation. CVE-2026-121639 permits disruption of authentication services by unauthenticated attackers. CVE-2026-121640 allows replay attacks for unauthorized administrative actions. No evidence of exploitation in the wild has been reported, but organizations are urged to apply patches immediately. 1 sources 72

Extracted Entities

CVE-2026-121638

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Vulnerabilities (1)