Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-121638: WatchGuard AuthPoint Gateway may let attackers intercept logins
CVE-2026-121638 · published today
Summary
The AuthPoint Gateway that connects to your authentication servers can be fooled by fake security certificates. An attacker who can see network traffic could read or change login information passing through the gateway. Update the product to the latest version or apply the vendor's recommended configuration changes to ensure proper certificate checking.
What to do
- Update watchguard authpoint authentication gateway to version 7.6.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| watchguard | authpoint authentication gateway | < 7.6.0 |
Original advisory text
WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta