WatchGuard fixes four AuthPoint Gateway flaws, including critical bug

WatchGuard has released urgent updates for AuthPoint Gateway to fix four flaws described as critical or high risk. WatchGuard AI Security Research found the vulnerabilities during internal testing, and the company’s PSIRT advisories, as well as MITRE CVE entries, corroborate the severity of the issues. The affected product is WatchGuard AuthPoint Authentication Gateway, and the four CVEs are CVE-2026-121639, CVE-2026-121638, CVE-2026-121640 and CVE-2026-121637. The advisory notes that none of the flaws have been exploited in the wild at the time of reporting.

In practical terms, the flaws enable a range of attacks against gateway–backend communications and authentication flows. CVE-2026-121639 (CVSS 9.2) stems from missing authentication checks on a key function, allowing a remote attacker with network access to disrupt login services and alter local folder sync settings. CVE-2026-121640 (CVSS 9.1) is a capture‑replay weakness that could let an attacker replay valid gateway requests to execute rogue admin tasks and halt authentication.

CVE-2026-121638 (CVSS 9.1) involves weak certificate validation, enabling on‑path attackers to intercept or modify traffic between the gateway and local login servers. CVE-2026-121637 (CVSS 8.9) concerns flawed HMAC validation in the LDAP authentication callback, permitting forged authentication results and rogue session IDs if a header signature is valid.

WatchGuard states that all four flaws affect AuthPoint Gateway versions from 1.0 up to, but not including, 7.6.0, with CVE-2026-121637 specifically affecting LDAP setups and CVE-2026-121639 impacting LDAP and Active Directory configurations. The vendor advises administrators to upgrade to version 7.6.0 immediately via the WatchGuard Cloud portal, and to restrict network access to the gateway host while reviewing logs for unusual activity. No active exploitation is acknowledged by WatchGuard at present.