CVE-2026-121639: Missing Authentication in AuthPoint Gateway

CVE-2026-121639 is a missing authentication vulnerability discovered in the WatchGuard AuthPoint Gateway. A critical function in the system does not require authentication to be invoked, allowing a remote unauthenticated attacker to access the service. This directly impacts the gateway's authentication services and allows deletion of the local directory synchronization configuration, with impact on availability and integrity of user synchronization.

The vulnerability has a CVSS score of 9.2, classified as critical. It was published on November 4, 2026. According to social media reports, three critical vulnerabilities in this product were discovered in the same timeframe, and for CVE-2026-121639 specifically a patch has been immediately released in version 7.6.0. No public exploits have been reported at time of publication, but the lack of authentication on a critical function in an authentication gateway makes it immediately exploitable.

For organizations using WatchGuard AuthPoint Gateway, the priority action is to update the system immediately to version 7.6.0 or later. In parallel, verify whether the gateway is directly exposed to the internet or uncontrolled networks, applying network segmentation and firewall rules to limit access to the administration network only. Audit gateway logs to identify any unauthorized access on or before the discovery date.

An authentication gateway is a critical component of the security infrastructure: its compromise can lead to blocking access services for legitimate users (denial of service) and loss of important configurations for user synchronization. Contact the vendor for configuration-specific guidance and to verify whether interim mitigations are applicable to your deployment.