WatchGuard AuthPoint Gateway vulnerability CVE-2026-121639: three critical advisories, install version 7.6.0
Four flaws, three of them critical, affect AuthPoint Gateway before 7.6.0. The upgrade is manual: versions, conditions, interim measures and checks to run.
The short answer: on 4 November 2026, WatchGuard published four security advisories on the AuthPoint Authentication Gateway, three of them critical. Every version from 1.0 up to but excluding 7.6.0 is affected, and the fixed version is 7.6.0. WatchGuard is not aware of any exploitation. The point that deserves your attention: this Gateway does not update itself, so nothing gets fixed unless you act.
The Gateway is a small piece of software installed on your network. It links the AuthPoint MFA service to your RADIUS, ADFS, Active Directory or LDAP systems. In other words, it sits exactly where access to your VPN and applications is decided. For its role and use cases, see our WatchGuard AuthPoint guide.
What is affected
The table below uses the CVSS v4.0 scores published by WatchGuard.
| CVE | Severity (CVSS v4.0) | Nature of the flaw | Configuration concerned |
|---|---|---|---|
| CVE-2026-121639 | Critical, 9.2 | Unauthenticated attacker with network access to the server: disrupts authentication and deletes the local directory sync configuration | LDAP or Active Directory provider |
| CVE-2026-121638 | Critical, 9.1 | Improper certificate validation: an on-path attacker can intercept and modify exchanges with local authentication providers | RADIUS, LDAP or ADFS resource |
| CVE-2026-121640 | Critical, 9.1 | Replay: an attacker who observed a legitimate request between Gateway components replays it to perform administrative actions | No condition stated |
| CVE-2026-121637 | High, 8.9 | Improper integrity check of the LDAP authentication callback: an attacker holding a valid header signature forges the result | LDAP provider |
| Product | Affected versions | Fixed version |
|---|---|---|
| AuthPoint Authentication Gateway | 1.0 and later, before 7.6.0 | 7.6.0 |
Source: WatchGuard PSIRT advisories of 4 November 2026 and maCERT bulletin 70630511/26. The release notes date Gateway 7.6.0 to 29 October 2026: a Gateway updated since that date is already on the right version.
Severity and exploitation
- Published severity: WatchGuard rates three advisories critical and one high. NVD received the four CVEs on 4 November, with no analysis of its own at this stage. Morocco’s maCERT (DGSSI) assigns a critical risk and impact level, listing security bypass, access to confidential information and denial of service as risks.
- Exploitation: WatchGuard states it is not aware of exploitation for each advisory. These CVEs are not in the CISA KEV catalog, in its 4 November 2026 version.
- Conditions: CVE-2026-121639 only requires network access to the server. The other three assume an eavesdropping position on the network, an observed request or an already obtained signature. A compromised internal workstation can sometimes meet these conditions: do not read them as a guarantee.
- Practical consequence: if the Gateway goes down or loses its sync, the MFA that depends on it can lock your users out. The risk therefore affects the availability of access, not just its security.
Updating the Gateway
WatchGuard’s procedure takes only a few steps:
- In the AuthPoint management interface, open Downloads.
- In the Gateway Installer section, download the installer for your operating system.
- Run it on the server. You do not need to uninstall the current version or enter a registration key.
- On the Gateway page, check that the status icon is green and the displayed version is 7.6.0.
- Test the connection to your external directories, then perform a real authentication (VPN or application).
Three points to check before starting the installation:
- Very old versions: below 3.1.3-83, you must uninstall the Gateway, unregister it, generate a new registration key and reinstall.
- Java: the Gateway requires Amazon Corretto 17 or 21, configured for the system rather than a single user. An older server may need this step first.
- ADFS: the AuthPoint agent for ADFS 1.2.4 requires Gateway 7.6.0 or later. Update the Gateway first.
Interim measures, if the update has to wait
WatchGuard’s advisories offer no workaround. The following measures are our own recommendations: they reduce exposure without replacing the update.
- Restrict network access to the server: only the RADIUS devices, the ADFS agent and the directories that need it should reach it. VLAN segmentation makes this filtering easier.
- Never expose the Gateway to the internet, even temporarily.
- Monitor: the Gateway going offline, loss of directory sync, repeated rejected logins.
- Back up the server and record the sync configuration, so you can restore it quickly if it were deleted.
Checks to run
- Inventory your Gateways: the AuthPoint Gateway page shows the version, IP address and status of each. Secondary Gateways, installed for failover, are in scope.
- Identify the uses: LDAP, Active Directory, RADIUS, ADFS. A Gateway synced with a directory goes to the top of the list.
- Review the sync configuration: a missing group or an empty sync must be explained.
- Check the logs: unexpected service stops and accepted authentications that match no user request.
- Check your Fireboxes: the October Fireware batch also fixed an AuthPoint MFA session flaw (CVE-2026-82332). See our alert on the Fireware OS patches.
What it means for businesses in Morocco
MFA is often considered done once deployed, and the Gateway stays on a server nobody looks at. These advisories are a reminder that a security component needs maintenance like everything else. Add it to your update cycle, with a regular check of the displayed version.
This alert does not call the value of MFA into question: it remains essential on remote access and RDP. It fits into a broader approach, with rolling out MFA across the business and hardening Active Directory, since the directory is precisely what the Gateway queries.
How we can help
As a WatchGuard partner in Morocco, we inventory your Gateways, prepare the Java prerequisite, install version 7.6.0 on primary and secondary servers, test your authentications and filter network access. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: WatchGuard PSIRT, CVE-2026-121639, CVE-2026-121638, CVE-2026-121640, CVE-2026-121637, AuthPoint release notes, AuthPoint upgrade notes, update an installed Gateway, about Gateways, NVD CVE-2026-121639, CISA KEV catalog, maCERT bulletin 70630511/26 (DGSSI).
Frequently asked questions
Am I affected if I only use AuthPoint in the cloud?
The advisories target the AuthPoint Authentication Gateway, the software installed on your network. If you have none, these four flaws do not apply to you. Check the Gateway page of the AuthPoint interface: each Gateway appears there with its version and status. A Gateway is required for RADIUS, ADFS or syncing an Active Directory or LDAP directory.
Are these flaws being exploited?
WatchGuard states for each of the four advisories that it is not aware of any exploitation. None of these CVEs appears in the CISA KEV catalog at the date of this article, in its 4 November 2026 version. Morocco’s maCERT (DGSSI) nevertheless rates the batch as critical risk and impact (bulletin 70630511/26).
Is the update applied automatically?
No. WatchGuard specifies that the Gateway does not update itself. You must download the installer from the Downloads page of the AuthPoint interface and run it on the server. You do not need to uninstall the current version or enter a registration key, except for versions older than 3.1.3-83.
Is there a workaround?
The advisories offer none: the only stated solution is version 7.6.0. Limiting network access to the Gateway server reduces exposure, especially for CVE-2026-121639, but does not replace the update.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
