# WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640) · pwn.watch

> WatchGuard published four advisories for the AuthPoint Authentication Gateway, the on-premises component that connects its AuthPoint MFA service to local LDAP and RADIUS authentication. CVE-2026-121637 (CVSS 8.9) lets a network attacker who has a valid header signature forge the authentication result and transaction id in the LDAP authentication callback. CVE-2026-121640 (9.1) lets an attacker who observed a legitimate request between Gateway components replay it to perform administrative actions. CVE-2026-121638 (9.1) is improper certificate validation that lets an on-path attacker intercept and modify traffic between the Gateway and local authentication providers. CVE-2026-121639 (9.2) is missing authentication that lets a remote unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration. All versions from 1.0 up to 7.6.0 are affected; update the AuthPoint Gateway to 7.6.0, released October 29.

Page: https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637 · generated 2026-11-04T18:43:52.585Z

## Status
- Severity: high · status: live · patch: patched
- Product: WatchGuard AuthPoint Authentication Gateway before 7.6.0
- Started: 2026-11-04
- CVEs: CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640
- Affected: AuthPoint Gateway 1.0 to before 7.6.0
- Fixed in: AuthPoint Gateway 7.6.0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637/feed.xml
- JSON Feed: https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637.json
- This file: https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637/llms.txt

## Updates (newest first)
- 2026-11-04: WatchGuard publishes advisories CVE-2026-121637, CVE-2026-121638, CVE-2026-121639 and CVE-2026-121640 for AuthPoint Gateway before 7.6.0. (https://psirt.watchguard.com/)
- 2026-10-29: WatchGuard releases AuthPoint Gateway 7.6.0, noting a resolved security vulnerability. (https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html)

## Fix brief
# Security brief: WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640)

Source: https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637 · status: live · severity: high · updated Nov 4, 2026, 15:25 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
WatchGuard published four advisories for the AuthPoint Authentication Gateway, the on-premises component that connects its AuthPoint MFA service to local LDAP and RADIUS authentication. CVE-2026-121637 (CVSS 8.9) lets a network attacker who has a valid header signature forge the authentication result and transaction id in the LDAP authentication callback. CVE-2026-121640 (9.1) lets an attacker who observed a legitimate request between Gateway components replay it to perform administrative actions. CVE-2026-121638 (9.1) is improper certificate validation that lets an on-path attacker intercept and modify traffic between the Gateway and local authentication providers. CVE-2026-121639 (9.2) is missing authentication that lets a remote unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration. All versions from 1.0 up to 7.6.0 are affected; update the AuthPoint Gateway to 7.6.0, released October 29.

Severity detail: WatchGuard CVSS 4.0 scores 8.9 to 9.2; most bugs need a network position or an observed request, CVE-2026-121639 is unauthenticated

- Product: WatchGuard AuthPoint Authentication Gateway before 7.6.0
- CVE / advisory ids: CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640

## Affected versions
- AuthPoint Gateway 1.0 to before 7.6.0

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- AuthPoint Gateway 7.6.0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 4, 2026: WatchGuard publishes advisories CVE-2026-121637, CVE-2026-121638, CVE-2026-121639 and CVE-2026-121640 for AuthPoint Gateway before 7.6.0.
- Oct 29, 2026: WatchGuard releases AuthPoint Gateway 7.6.0, noting a resolved security vulnerability.

## Advisories
- [CVE-2026-121637 AuthPoint Gateway improper HMAC validation in LDAP authentication callback](https://psirt.watchguard.com/CVE-2026-121637) (WatchGuard)
- [CVE-2026-121638 AuthPoint Gateway improper certificate validation](https://psirt.watchguard.com/CVE-2026-121638) (WatchGuard)
- [CVE-2026-121639 AuthPoint Gateway unauthenticated denial of service](https://psirt.watchguard.com/CVE-2026-121639) (WatchGuard)
- [CVE-2026-121640 AuthPoint Gateway capture-replay](https://psirt.watchguard.com/CVE-2026-121640) (WatchGuard)
- [CVE-2026-121637](https://nvd.nist.gov/vuln/detail/CVE-2026-121637) (NVD)
- [AuthPoint release notes (Gateway 7.6.0)](https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html) (WatchGuard)

---
Machine-readable: https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.