CVE-2026-121638#

WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

Critical 9.1 CVSS v4.0 › Published 2026-11-04Updated 2026-11-04

Summary #

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.

Product status #

Product	Affected	Not affected
AuthPoint Authentication Gateway	>= 1.0, < 7.6.0	>= 7.6.0

Required Configuration for Exposure #

This vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource.

Weakness Type and Impact #

CWECWE-295Improper Certificate Validation
CAPECCAPEC-94Adversary in the Middle (AiTM)

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

AuthPoint Authentication Gateway 7.6.0

References #

Credits #

WatchGuard AI Security Researchfinder