WatchGuard Patches Four Critical/High AuthPoint Gateway Flaws Enabling DoS, Traffic Interception and Session Forgery
WatchGuard has released version 7.6.0 of AuthPoint Authentication Gateway to fix four vulnerabilities discovered internally by WatchGuard AI Security Research, three rated critical and one high, with the top score reaching 9.2 (CVSSv4). The flaws allow unauthenticated denial of service, replay-based rogue admin actions, traffic interception via weak certificate validation, and session/login-result forgery through broken HMAC checks on the LDAP callback. All versions from 1.0 before 7.6.0 are affected, impacting environments tied to LDAP, Active Directory, RADIUS, or ADFS. WatchGuard states there is no evidence of active exploitation or public exploit code at this time.
Entenda a falha
A vulnerabilidade
Four flaws in WatchGuard AuthPoint Authentication Gateway, all versions from 1.0 before 7.6.0, fixed in 7.6.0. CVE-2026-121639 (CVSS v4 9.2) is missing authentication on a critical function (CWE-306): a remote unauthenticated attacker can halt login services and delete local folder sync settings (LDAP and Active Directory setups). CVE-2026-121640 (9.1) is a capture-replay flaw (CWE-294): an attacker who sees a valid inter-component request can replay it to run rogue admin tasks and disrupt login. CVE-2026-121638 (9.1) is improper certificate validation (CWE-295): an on-path attacker can intercept and alter traffic between the gateway and RADIUS, LDAP or ADFS servers. CVE-2026-121637 (8.9) is flawed HMAC verification in the LDAP callback (CWE-345): an attacker with a valid header signature can forge login results and session IDs.
Como funciona
The gateway links local user directories (LDAP, Active Directory, RADIUS, ADFS) to WatchGuard's cloud login services, so it exchanges requests between its own components and with those servers. For the missing-authentication flaw, a request to a critical function is accepted without verifying who sent it. For the replay flaw, a legitimate request between components is accepted again when resent. For the certificate flaw, the gateway does not properly verify the identity of the local authentication server it connects to, so a party in the middle can sit in the path. For the LDAP callback, the HMAC check on the message is flawed, so the login result and session ID in the body are trusted even when altered.
Por que é vulnerável
The root causes are missing or weak verification of trust: no authentication on a critical function, no protection against replayed requests, incomplete certificate validation, and an incorrect HMAC verification that does not properly prove message integrity. The articles do not explain why these went unnoticed or detail what the 7.6.0 code changes beyond fixing these checks.
Como foi descoberta
WatchGuard AI Security Research found all four flaws during internal testing. The WatchGuard PSIRT advisories and the MITRE CVE database document them, and the fix shipped in version 7.6.0, available via the WatchGuard Cloud portal. WatchGuard states it has no evidence of exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 16:15.
Detalhes técnicos
- CVE-2026-121639 (CVSS 9.2) — Missing authentication for a critical function (CWE-306) allows a remote, unauthenticated attacker to halt login services and delete local folder sync settings.
- CVE-2026-121640 (CVSS 9.1) — Capture-replay flaw (CWE-294) lets an attacker who observes a valid inter-component request replay it to execute rogue administrative tasks and disrupt login services.
- CVE-2026-121638 (CVSS 9.1) — Improper certificate validation (CWE-295) enables an on-path attacker to intercept and tamper with traffic between the gateway and local authentication servers (RADIUS, LDAP, ADFS).
- CVE-2026-121637 (CVSS 8.9) — Flawed HMAC verification in the LDAP callback (CWE-345) allows a network attacker with a valid header signature to forge login results and session IDs for rogue access.
Remediação
Upgrade WatchGuard AuthPoint Gateway to version 7.6.0 immediately via the WatchGuard Cloud portal. Until patched, restrict network access to the gateway host and audit logs for anomalous configuration or admin activity changes.
Linha do tempo
-
WatchGuard Patches Four Critical/High AuthPoint Gateway Flaws Enabling DoS, Traffic Interception and Session Forgery
ler a análise desta fonte ocultar
WatchGuard has released version 7.6.0 of AuthPoint Authentication Gateway to fix four vulnerabilities discovered internally by WatchGuard AI Security Research, three rated critical and one high, with the top score reaching 9.2 (CVSSv4). The flaws allow unauthenticated denial of service, replay-based rogue admin actions, traffic interception via weak certificate validation, and session/login-result forgery through broken HMAC checks on the LDAP callback. All versions from 1.0 before 7.6.0 are affected, impacting environments tied to LDAP, Active Directory, RADIUS, or ADFS. WatchGuard states there is no evidence of active exploitation or public exploit code at this time.
Technical Details
- CVE-2026-121639 (CVSS 9.2) — Missing authentication for a critical function (CWE-306) allows a remote, unauthenticated attacker to halt login services and delete local folder sync settings.
- CVE-2026-121640 (CVSS 9.1) — Capture-replay flaw (CWE-294) lets an attacker who observes a valid inter-component request replay it to execute rogue administrative tasks and disrupt login services.
- CVE-2026-121638 (CVSS 9.1) — Improper certificate validation (CWE-295) enables an on-path attacker to intercept and tamper with traffic between the gateway and local authentication servers (RADIUS, LDAP, ADFS).
- CVE-2026-121637 (CVSS 8.9) — Flawed HMAC verification in the LDAP callback (CWE-345) allows a network attacker with a valid header signature to forge login results and session IDs for rogue access.
Remediation
Upgrade WatchGuard AuthPoint Gateway to version 7.6.0 immediately via the WatchGuard Cloud portal. Until patched, restrict network access to the gateway host and audit logs for anomalous configuration or admin activity changes.