CVE-2026-121639 WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

CriticalCVSS 9.2

Published: 2026-11-04 16:44
Updated: 2026-11-04 20:20
Exploit status: No public exploit known

Description

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

Affected products

Product	Affected versions	Fixed in
WatchGuard AuthPoint Authentication Gateway	>= 1.0, < 7.6.0	7.6.0

References

psirt.watchguard.com vendor-advisory

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: None
Vulnerable System Integrity: Low
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-252 CWE-287 CWE-306

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.