CVE-2026-121640

psirt.watchguard.com • November 6, 2026

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

Weakness Type and Impact #

CWE CWE-294 Authentication Bypass by Capture-replay

CAPEC CAPEC-60 Reusing Session IDs (aka Session Replay)

Exploitation Status #

WatchGuard AI Security Research finder

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard AuthPoint Gateway Require Immediate Attention WatchGuard has disclosed four critical vulnerabilities in its AuthPoint Authentication Gateway, affecting versions 1.0 to below 7.6.0. The vulnerabilities include CVE-2026-121637 (8.9), CVE-2026-121638 (9.1), CVE-2026-121639 (9.2), and CVE-2026-121640 (9.1). CVE-2026-121637 allows unauthorized session outcomes through improper HMAC validation in LDAP authentication. CVE-2026-121638 enables a Man-in-the-Middle attack due to improper certificate validation. CVE-2026-121639 permits disruption of authentication services by unauthenticated attackers. CVE-2026-121640 allows replay attacks for unauthorized administrative actions. No evidence of exploitation in the wild has been reported, but organizations are urged to apply patches immediately. 1 sources 72

Extracted Entities

CVE-2026-121640

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Vulnerabilities (1)