CVE-2026-1216409.1Critical
CVE-2026-121640: WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions
WatchGuard · AuthPoint Authentication Gateway
Vendor fix available · Affected: WatchGuard AuthPoint Authentication Gateway · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 4 Nov.
Developinglatest 48 minutes ago2 articles2 outlets
- Wed 4 Nov, 20:00 UTC. SecurityOnline, first report. WatchGuard fixes four AuthPoint Gateway flaws, including critical bug.
- Thu 5 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 4 Nov 20:00 | SecurityOnline | WatchGuard fixes four AuthPoint Gateway flaws, including critical bug |
| 5 Nov 13:30 | SecurityWeek | Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed |
- Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixedSecurityWeek · mentions it in passing
- WatchGuard fixes four AuthPoint Gateway flaws, including critical bugSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.