Vulnerability · Published Nov 4, 2026 · Assigned by WatchGuard
CVE-2026-121639WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service
Critical 9.2
In plain English
A critical-severity improper authentication in AuthPoint Authentication Gateway from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | AuthPoint Authentication Gateway | 1.0 – before 7.6.0 |
Weakness: CWE-252, CWE-287, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H
References
- https://psirt.watchguard.com/CVE-2026-121639 vendor-advisory