Description
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Published: 2026-11-04
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: Denial of Service and configuration deletion
Action: Patch Immediately
AI Analysis

Impact

The AuthPoint Authentication Gateway contains a missing authentication flaw in a critical function. An attacker who can reach the gateway host over the network can trigger the flaw without credentials, causing authentication services to fail and permanently deleting the local directory synchronization configuration. The result is a denial of service to users seeking to authenticate and a loss of configuration that may require manual re‑creation.

Affected Systems

The affected product is WatchGuard AuthPoint Authentication Gateway. The specific versions that are impacted are not enumerated, but the vendor recommends upgrading to version 7.6.0 or later. Customers running earlier releases that have not applied this update are exposed.

Risk and Exploitability

The CVSS score of 9.2 indicates a high‑severity vulnerability. Because it is unauthenticated and requires only network access to the gateway host, the attack vector is exploitable from any host with connectivity to the gateway. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but its severity and accessibility make it a top priority for remediation.

Generated by OpenCVE AI on November 4, 2026 at 17:01 UTC.

Remediation

Vendor Solution

AuthPoint Authentication Gateway 7.6.0

OpenCVE Recommended Actions

  • Upgrade WatchGuard AuthPoint Authentication Gateway to version 7.6.0 or later.
  • If an immediate upgrade is not possible, isolate the gateway from public or untrusted networks to limit exposure.
  • As a temporary safeguard, enforce network segmentation and restrict access to the gateway host via firewall rules or VPN to reduce attack surface.

Generated by OpenCVE AI on November 4, 2026 at 17:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Nov 2026 15:00:00 +0000

Type Values Removed Values Added
Description A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Title WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service
First Time appeared Watchguard
Watchguard authpoint Authentication Gateway
Weaknesses CWE-252
CWE-287
CWE-306
CPEs cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard authpoint Authentication Gateway
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H'}

Subscriptions

Watchguard Authpoint Authentication Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-11-04T18:20:22.160Z

Reserved: 2026-11-03T17:27:11.834Z

Link: CVE-2026-121639

cve-icon Vulnrichment

Updated: 2026-11-04T18:11:56.162Z

cve-icon NVD

Status : Received

Published: 2026-11-04T15:17:42.600

Modified: 2026-11-04T19:17:31.773

Link: CVE-2026-121639

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T17:15:14Z

Weaknesses
  • CWE-252

    Unchecked Return Value

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function