WatchGuard has fixed three critical flaws in AuthPoint Authentication Gateway that let attackers knock out authentication, intercept traffic with the directory or perform administrator actions. All versions before 7.6.0 are affected. If you use this Gateway to connect multi-factor authentication with Active Directory, LDAP, RADIUS or ADFS, update to 7.6.0 today.
The essentials
- INCIBE-CERT published advisory INCIBE-2026-840 on 5 November 2026 with importance level 5 (critical). It affects AuthPoint Authentication Gateway from version 1.0 up to, but not including, 7.6.0.
- CVE-2026-121639 (critical): missing authentication for a critical function. A remote, unauthenticated attacker with network access to the appliance can disrupt authentication and delete the local directory synchronisation configuration. It affects installations configured with LDAP or Active Directory.
- CVE-2026-121638 (critical): improper certificate validation lets an attacker in the communication path intercept and modify traffic between the Gateway and local authentication providers. It affects installations configured with RADIUS, LDAP or ADFS.
- CVE-2026-121640 (critical): replaying a captured legitimate request between Gateway components allows authentication bypass and unauthorised administrative actions, including disrupting the service.
- No known exploitation. The flaws were found by the WatchGuard AI Security Research team. SecurityWeek adds that WatchGuard also fixed a fourth, high-severity integrity validation flaw (CVE-2026-121637).
Does this affect me if I use WatchGuard?
Only if you have AuthPoint Authentication Gateway installed. It is the component that connects AuthPoint multi-factor authentication with your on-premises directory: Active Directory, LDAP, RADIUS or ADFS. If you don't use WatchGuard AuthPoint, you don't need to do anything about this advisory.
The catch is that many companies don't know whether they have it. Your IT provider or MSP installed it years ago, it works, and nobody has looked at it since. Affected versions start at 1.0, so any installation that hasn't been updated recently is in scope.
Each flaw depends on configuration. CVE-2026-121639 affects those syncing with LDAP or Active Directory. CVE-2026-121638 affects those using RADIUS, LDAP or ADFS. For CVE-2026-121640 the advisory sets no configuration limit. In practice: if you have the Gateway, assume you are affected.
What can happen if I don't update?
Three scenarios, all at the most sensitive point of your network: access control.
- Nobody can log in. If the Gateway goes down, your staff may be unable to authenticate. If the directory synchronisation configuration is also deleted, recovery isn't instant.
- Someone reads and changes what your directory says. Intercepting and modifying traffic between the Gateway and the authentication provider undermines exactly what multi-factor authentication was meant to protect.
- Someone acts as an administrator without ever authenticating.
None of the three requires credentials. They do require some kind of position: network access to the appliance, being in the communication path, or having captured a request between components. That's why restricting who can reach the Gateway reduces the risk while you update.
What to do today
- Ask your IT lead or MSP whether you have AuthPoint Gateway installed and which version it runs.
- If it's older than 7.6.0, update to 7.6.0 or later.
- Until you update, restrict network access to the Gateway appliance to only the systems that need it.
- After updating, check that directory synchronisation and MFA sign-in still work.
What it means for a small business
Multi-factor authentication is sold, rightly, as the measure that stops the most attacks. But the component connecting it to your directory is software too, and if it fails, the whole door fails. Here three critical flaws sit in that same piece: one locks your staff out, another lets someone tamper with the conversation with your directory, and a third grants administrator actions without authentication.
No known exploitation gives you time, not an excuse. The fix is a single update and it's available. What usually holds a small business back isn't technical difficulty but not knowing who looks after the Gateway. If the answer is "the MSP", ask them today for written confirmation of the installed version.
And there's a lesson beyond this advisory: authentication appliances shouldn't be reachable from anywhere on the network. Two of these flaws depend on network access or being in the communication path. Good segmentation limits the damage from the next flaw, whether it's WatchGuard's or another vendor's. If you want to review how your access control is set up, that's what we do in cybersecurity.
Frequently asked questions
Are these flaws being exploited?
No. INCIBE-CERT rates all three as critical with no known exploitation.
Which version fixes the flaws?
AuthPoint Authentication Gateway 7.6.0. All versions from 1.0 up to, but not including, 7.6.0 are affected.
Do I need to do anything if I don't use AuthPoint?
No. The advisory only affects AuthPoint Authentication Gateway.
