# WatchGuard AuthPoint: update the gateway and review authentication paths Canonical: https://www.oktsec.com/radar/watchguard-authpoint-gateway-security-update Publisher: Oktsec Language: en Published: 2026-11-04T20:47:43Z Updated: 2026-11-04T20:47:43Z Record reviewed: 2026-11-04T20:47:43Z Latest evidence check: 2026-11-04T20:47:43Z Disclosed: 2026-11-04 WatchGuard fixed four AuthPoint Gateway vulnerabilities in version 7.6.0, covering authentication integrity and service disruption under distinct conditions. The vendor reports no known exploitation. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The manufacturer provides corrections for authentication and availability risks. Exposure depends on provider configuration, network access or captured requests; no exploitation is known to WatchGuard. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: WatchGuard - Products: AuthPoint Authentication Gateway - CVEs: CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640 ## Technical overview AuthPoint Gateway versions from 1.0 to before 7.6.0 require an update. WatchGuard states that it is not aware of exploitation of the four vulnerabilities. The risks must be assessed separately rather than described as one universal authentication bypass. CVE-2026-121637 concerns LDAP authentication callbacks. An attacker who has obtained a valid header signature can alter the authentication result and transaction identifier. CVE-2026-121638 requires a position between communicating systems and affects deployments using RADIUS, LDAP or ADFS resources. CVE-2026-121639 allows an attacker with network access to the gateway host to disrupt authentication and delete local directory synchronization configuration without logging in. The vendor scopes this issue to LDAP or Active Directory deployments. CVE-2026-121640 requires an observed legitimate request between gateway components, which can be replayed for unauthorized administrative actions. Oktsec recommends updating all gateway instances and checking both authentication and directory synchronization afterward. Restricting access is useful exposure reduction, but does not replace the corrected software. A failure of authentication services is a reason to investigate, not proof by itself that these vulnerabilities were exploited. ## Recommended response Update AuthPoint Authentication Gateway to 7.6.0 or a later corrected release, restrict gateway access and verify authentication and directory synchronization afterward. Relevant to: Identity and infrastructure teams operating AuthPoint Authentication Gateway, especially gateways linked to LDAP, Active Directory, RADIUS or ADFS. ## CVE attribution - CVE-2026-121637: WatchGuard — AuthPoint Authentication Gateway. [Source](https://psirt.watchguard.com/CVE-2026-121637) - CVE-2026-121638: WatchGuard — AuthPoint Authentication Gateway. [Source](https://psirt.watchguard.com/CVE-2026-121638) - CVE-2026-121639: WatchGuard — AuthPoint Authentication Gateway. [Source](https://psirt.watchguard.com/CVE-2026-121639) - CVE-2026-121640: WatchGuard — AuthPoint Authentication Gateway. [Source](https://psirt.watchguard.com/CVE-2026-121640) ## Affected systems and fixes ### AuthPoint Authentication Gateway Affected: 1.0 and later, before 7.6.0. Check the prerequisites for each CVE described below. Fixed release / action: 7.6.0 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.03 Checked: 2026-11-03T22:13:58Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-121637, CVE-2026-121638, CVE-2026-121639, CVE-2026-121640 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z. ## Response checklist 1. **Inventory gateways and provider connections** — Record gateway versions and configured LDAP, Active Directory, RADIUS and ADFS resources. Identify every network path to the gateway, including internal segments and management services. 2. **Deploy version 7.6.0 or later with the fixes** — Use WatchGuard’s supported upgrade process and plan for authentication continuity. Verify the version on each gateway instance; an updated console does not prove every gateway has updated. 3. **Limit access to gateway services** — Allow only the required trusted components and administration paths. Review network protections between the gateway and authentication providers, accounting for the interception and replay prerequisites. 4. **Test authentication and review anomalies** — Verify expected authentication outcomes and directory synchronization after the update. Investigate unexplained authentication results, synchronization changes and service disruption. If evidence indicates account compromise, preserve logs and recover affected access. ## Relevance to AI environments Authentication gateways protect access to business applications and automation environments. This is an identity infrastructure risk, not evidence of an attack on AI agents. ## Sources - [LDAP callback integrity and forged authentication results](https://psirt.watchguard.com/CVE-2026-121637) — WatchGuard; Vendor notice; checked 2026-11-04T20:41:46Z - [Certificate validation between gateway and authentication providers](https://psirt.watchguard.com/CVE-2026-121638) — WatchGuard; Vendor notice; checked 2026-11-04T20:41:46Z - [Unauthenticated disruption of directory services](https://psirt.watchguard.com/CVE-2026-121639) — WatchGuard; Vendor notice; checked 2026-11-04T20:41:46Z - [Replay of administrative requests](https://psirt.watchguard.com/CVE-2026-121640) — WatchGuard; Vendor notice; checked 2026-11-04T20:41:46Z ## Editorial record - 2026-11-04T20:47:43Z: Added verified scope, source evidence and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/watchguard-authpoint-gateway-security-update) · [Build a response plan](https://www.oktsec.com/radar/watchguard-authpoint-gateway-security-update#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=watchguard-authpoint-gateway-security-update&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=watchguard-authpoint-gateway-security-update&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.