---
title: WatchGuard fixes four AuthPoint Gateway flaws, including unauthenticated disruption of MFA and replayable admin requests; upgrade to 7.6.0 | ctxsec
url: https://ctxsec.com/items/watchguard-authpoint-gateway-7-6-0-four-flaws-auth-replay-mitm
description: "WatchGuard's AuthPoint Authentication Gateway, which connects the AuthPoint MFA service to on-prem directories such as AD/LDAP, has four flaws fixed in 7.6.0: CVE-2026-121639 lets an unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration (CVSS 4.0 9.2); CVE-2026-121640 lets someone who captured a legitimate request between gateway components replay it for admin actions; CVE-2026-121638 is missing certificate validation that allows on-path interception of traffic to local authentication providers; CVE-2026-121637 lets an attacker holding a valid header signature forge LDAP authentication results. WatchGuard also published advisories on the Linux TCP bug CVE-2026-98432 for its products. It says none of these are known to be exploited."
status: "official (WatchGuard PSIRT advisories via NVD, Nov 4; Canadian Cyber Centre AV26-1125); no exploitation reported"
published: 2026-11-04
---

> WatchGuard's AuthPoint Authentication Gateway, which connects the AuthPoint MFA service to on-prem directories such as AD/LDAP, has four flaws fixed in 7.6.0: CVE-2026-121639 lets an unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration (CVSS 4.0 9.2); CVE-2026-121640 lets someone who captured a legitimate request between gateway components replay it for admin actions; CVE-2026-121638 is missing certificate validation that allows on-path interception of traffic to local authentication providers; CVE-2026-121637 lets an attacker holding a valid header signature forge LDAP authentication results. WatchGuard also published advisories on the Linux TCP bug CVE-2026-98432 for its products. It says none of these are known to be exploited.

[← Cybersecurity News](/news) · [markdown](/items/watchguard-authpoint-gateway-7-6-0-four-flaws-auth-replay-mitm.md)

official (WatchGuard PSIRT advisories via NVD, Nov 4; Canadian Cyber Centre AV26-1125); no exploitation reported

2026-11-04

### WatchGuard fixes four AuthPoint Gateway flaws, including unauthenticated disruption of MFA and replayable admin requests; upgrade to 7.6.0

**What to do:** upgrade AuthPoint Gateway to 7.6.0 or later. Keep the gateway host reachable only from the systems that need it, since the worst flaw needs only network access and would knock out MFA for anything relying on it. Make sure you have a tested break-glass sign-in path if the gateway goes down.

Sources: [WatchGuard PSIRT: CVE-2026-121639](https://psirt.watchguard.com/CVE-2026-121639) · [NVD: CVE-2026-121639](https://nvd.nist.gov/vuln/detail/cve-2026-121639) · [Canadian Centre for Cyber Security: WatchGuard security advisory (AV26-1125)](https://www.cyber.gc.ca/en/alerts-advisories/watchguard-security-advisory-av26-1125) · [SecurityWeek: Cisco, WatchGuard Release Patches; SonicWall Won't Fix GMS Flaws (Nov 5)](https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/)