WatchGuard released AuthPoint Authentication Gateway 7.6.0 to fix four vulnerabilities in earlier versions, including three critical flaws that could disrupt authentication services, enable unauthorized administrative actions or expose communications to interception.
All four issues affect AuthPoint Authentication Gateway versions earlier than 7.6.0. An unauthenticated remote attacker can exploit CVE-2026-121639 against gateways configured with LDAP or Active Directory to disrupt authentication and delete the local directory synchronization configuration. CVE-2026-121640 allows an attacker who has observed a legitimate request between gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
Two other flaws affect different configurations. CVE-2026-121638 could let an on-path attacker intercept or modify communications between the gateway and RADIUS, LDAP or ADFS providers. CVE-2026-121637 allows an attacker with a valid header signature to forge authentication results and transaction identifiers in LDAP callback requests. WatchGuard says it is not aware of exploitation of these vulnerabilities in the wild.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
