Multiple Vulnerabilities Addressed in WatchGuard AuthPoint Authentication Gateway, Patch ...

CVE-2026-121637: 8.9 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N)

CVE-2026-121638: 9.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)

CVE-2026-121639: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H)

CVE-2026-121640: 9.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H)

WatchGuard has addressed four critical vulnerabilities affecting AuthPoint Authentication Gateway. WatchGuard AuthPoint Gateway is a component of WatchGuard AuthPoint, a multi-factor authentication (MFA) solution used by businesses to secure access to their IT systems. It enables communication between AuthPoint and your RADIUS clients, the AuthPoint agent for ADFS, and your Active Directory or LDAP database.

CVE-2026-121637 relates to Improper HMAC validation in LDAP authentication callbacks. This vulnerability could allow a network attacker who has obtained a valid header signature to change the authentication result and the transaction identifier within the request body, potentially resulting in unauthorized session outcomes.

CVE-2026-121638 is an improper certificate validation vulnerability. This vulnerability could allow a network-based attacker positioned between the AuthPoint Gateway and local authentication providers to intercept and modify communications through a Man-in-the-Middle (MitM) attack.

CVE-2026-121639 is a missing authentication for critical function in the WatchGuard AuthPoint Gateway. Successful exploitation could allow a remote, unauthenticated attacker with network access to the Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

CVE-2026-121640 relates to an authentication bypass vulnerability. This vulnerability could allow an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

WatchGuard PSIRT has not identified any evidence of these vulnerabilities being exploited in the wild.

CVE-2026-121637 (CVSS v4.0: 8.9) affects WatchGuard AuthPoint Authentication Gateway versions 1.0 up to, but not including, 7.6.0, specifically deployments configured with an LDAP provider. The vulnerability involves improper integrity validation in LDAP authentication callbacks. It could allow a network-based attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, potentially resulting in unauthorized authentication session outcomes.

CVE-2026-121638 (CVSS v4.0: 9.1) affects WatchGuard AuthPoint Authentication Gateway versions 1.0 up to, but not including, 7.6.0, specifically deployments configured with RADIUS, LDAP or ADFS resources. The vulnerability involves improper certificate validation, which could allow an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers through a Man-in-the-Middle (MitM) attack.

CVE-2026-121639 (CVSS v4.0: 9.2) affects WatchGuard AuthPoint Authentication Gateway versions 1.0 up to, but not including, 7.6.0, specifically deployments configured with an LDAP or Active Directory provider. The vulnerability involves missing authentication for a critical function, which could allow a remote, unauthenticated attacker with network access to the Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

CVE-2026-121640 (CVSS v4.0: 9.1) affects WatchGuard AuthPoint Authentication Gateway versions 1.0 up to, but not including, 7.6.0. The vulnerability involves an authentication bypass through a capture-replay attack. It could allow an attacker who has observed a legitimate request exchanged between AuthPoint Gateway components to replay that request and perform unauthorized administrative actions, including disrupting authentication services.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.