CVE-2026-121639#

WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

Critical 9.2 CVSS v4.0 › Published 2026-11-04Updated 2026-11-04

Summary #

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

Product status #

Product	Affected	Not affected
AuthPoint Authentication Gateway	>= 1.0, < 7.6.0	>= 7.6.0

Required Configuration for Exposure #

This vulnerability affects AuthPoint Gateway deployments configured with an LDAP or Active Directory provider.

Weakness Type and Impact #

CWECWE-252Unchecked Return Value
CWECWE-287Improper Authentication
CWECWE-306Missing Authentication for Critical Function
CAPECCAPEC-115Authentication Bypass

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

AuthPoint Authentication Gateway 7.6.0

References #

Credits #

WatchGuard AI Security Researchfinder