Vulnerability · Published Nov 4, 2026 · Assigned by WatchGuard
CVE-2026-121640WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions
Critical 9.1
In plain English
A critical-severity security flaw in AuthPoint Authentication Gateway from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 4.0)9.1Critical
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | AuthPoint Authentication Gateway | 1.0 – before 7.6.0 |
Weakness: CWE-294 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
References
- https://psirt.watchguard.com/CVE-2026-121640 vendor-advisory