CVE-2026-121639
Received Received - Intake

Missing Authentication Flaw in WatchGuard AuthPoint Gateway

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WatchGuard Technologies, Inc.

Description
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121639
EUVD
EUVD-2026-116932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WatchGuard AuthPoint Authentication Gateway 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Missing Authentication for Critical Function issue in WatchGuard AuthPoint Gateway. It allows a remote unauthenticated attacker with network access to disrupt authentication services and delete the local directory synchronization configuration. The vulnerability affects deployments using LDAP or Active Directory providers.

Detection Guidance

Detecting this vulnerability requires checking if WatchGuard AuthPoint Gateway is running a vulnerable version without authentication for critical functions. Inspect network traffic for unauthenticated LDAP or Active Directory synchronization requests to the AuthPoint Gateway. Verify if the system allows remote unauthenticated access to critical functions like directory sync deletion.

Impact Analysis

An attacker could disrupt authentication services, preventing legitimate users from accessing systems. They could also delete the local directory synchronization configuration, causing loss of user data and access controls. This could lead to unauthorized access or denial of service.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. It may result in non-compliance due to loss of authentication integrity and potential exposure of sensitive data.

Mitigation Strategies

Immediately upgrade to AuthPoint Authentication Gateway version 7.6.0 or later to address the missing authentication vulnerability. Ensure all AuthPoint Gateway deployments using LDAP or Active Directory providers are updated. Monitor for unauthorized changes to directory synchronization configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...