WatchGuard AuthPoint Gateway: four authentication flaws, three of them critical. Install 7.6.0 by hand

WatchGuard published four AuthPoint Authentication Gateway advisories on November 4. Three are critical. The gateway is the on-premises piece that talks to LDAP and Active Directory for AuthPoint MFA, and it does not upgrade itself.

Fixed builds start at AuthPoint Gateway 7.6.0, which shipped on October 29. WatchGuard and SecurityWeek say they have no reports of exploitation so far.

AuthPoint Gateway does not auto-update. Download 7.6.0 from the management UI, install it, and confirm the gateway shows green.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

WatchGuard patched four AuthPoint Gateway flaws

CVE-2026-121639 (9.2) is missing authentication for a critical function. A remote attacker who can reach the gateway host can disrupt authentication services and delete the local directory synchronization configuration.

CVE-2026-121638 (9.1) is improper certificate validation. An on-path attacker can intercept and modify traffic between the gateway and local authentication providers.

CVE-2026-121640 (9.1) is capture-replay. An attacker who has seen a legitimate request between gateway components can replay it and perform unauthorized administrative actions, including disrupting authentication.

CVE-2026-121637 (8.9, high) is improper HMAC validation on the LDAP authentication callback. An attacker who already has a valid header signature can forge the authentication result and transaction identifier.

• Affected: AuthPoint Authentication Gateway from 1.0 up to, but not including, 7.6.0.
• Fixed: 7.6.0 and later. Canadian Centre for Cyber Security relayed the set as AV26-1125 on November 4.

The box that syncs MFA to your directory

AuthPoint Gateway sits on the path of MFA for VPN, cloud apps and directory-backed logins. Taking it offline or forging authentication results hits every user who depends on that gateway. Capture-replay and certificate failures matter most when the gateway is reachable across a network segment an attacker can already stand in.

The update is manual. WatchGuard’s own docs say you download the installer from the AuthPoint management UI’s Downloads page and run it; you do not need a new registration key, and you should not uninstall the old gateway first.

Install AuthPoint Gateway 7.6.0 from the Downloads page

• In the AuthPoint management UI, open Downloads, download the Gateway installer for your OS, and run it on every gateway host.
• On the Gateway page, confirm the status icon is green and the version reads 7.6.0 or newer.
• Test the connection to each LDAP or Active Directory external identity after the upgrade.
• Restrict management and sync traffic for the gateway to the hosts that need it, and put the gateway off the public internet if it is still reachable there.

Details

• CVE-2026-121639: missing authentication, unauthenticated DoS and directory-sync deletion. CVSS 9.2.
• CVE-2026-121638: improper certificate validation, on-path modification of gateway-to-provider traffic. CVSS 9.1.
• CVE-2026-121640: capture-replay of inter-component requests → unauthorized admin actions. CVSS 9.1.
• CVE-2026-121637: improper HMAC validation on LDAP callback → forged authentication results. CVSS 8.9.
• Fixed: AuthPoint Gateway 7.6.0 (released October 29, advisories November 4). Exploitation: none reported by WatchGuard as of November 4.

Hunt / verify

• Inventory AuthPoint Gateway hosts and record the version shown in the AuthPoint management UI.
• Review gateway and directory logs around authentication failures, sync deletions and unexpected admin actions since the advisory date.
• Confirm no AuthPoint Gateway management port is reachable from the internet: check firewall and external scan results for those hosts.

Source: WatchGuard PSIRT advisories; Update an installed gateway

Sources

• WatchGuard Security Advisories (CVE-2026-121637, -121638, -121639, -121640)
• WatchGuard: Update an Installed Gateway
• WatchGuard: AuthPoint Agent Releases (Gateway 7.6.0)
• Canadian Centre for Cyber Security: WatchGuard security advisory AV26-1125
• CVE.org: CVE-2026-121639
• CVE.org: CVE-2026-121638
• CVE.org: CVE-2026-121640
• CVE.org: CVE-2026-121637

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].