Four CVEs in AuthPoint, and none of them touch the second factor

On 4 November at 14:44 UTC, WatchGuard published four vulnerability records for the same product: AuthPoint Authentication Gateway, from version 1.0 up to anything below 7.6.0. CVSS v4 scores of 9.2, 9.1, 9.1 and 8.9. If you read the four descriptions one after another, there is one word that appears in none of them: factor.

Three of the four are about the network stretch between the gateway and your local authentication servers, or between the gateway's own components. The fourth is about the machine it runs on. What all four share is an assumption: where that gateway is installed, and who can get in the middle.

The four, one by one

All four are fixed in 7.6.0, the first version not affected. All four are credited to "WatchGuard AI Security Research" — the vendor found them in its own testing. None is recorded as exploited. And they do not all apply to every deployment, because the records say so themselves: 121637 affects only installations with an LDAP provider; 121638, those with a RADIUS, LDAP or ADFS resource; 121639, those with LDAP or Active Directory; 121640 carries no such note.

The vector, metric by metric

Four scores between 8.9 and 9.2 look like a fire. The vector tells a different story, and it is worth reading before deciding what hour of the day you touch the gateway. Three of the four carry AT:P: in CVSS v4 that is Attack Requirements: Present, meaning the attack needs conditions outside the attacker's control. Here that condition is always the same one: being in the middle. On-path between the gateway and the domain controller, or having watched a legitimate request go by, or having obtained a valid header signature.

The exception is 121639, the only one carrying AT:N — no preconditions — with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H. That is the one that can take the authentication service down with no requirement beyond reaching the host over the network. It is also the only one of the four whose integrity impact stays Low (VI:L): its damage is to availability.

There is another detail in the vector that changes the reading: in three of the four, VC:N. Confidentiality, none. The exception is 121638, the on-path one, which can indeed read what goes past. The other three are not designed to read anything from you: they are designed to decide on your behalf. In 121637 and 121640 what rises to high is integrity — and specifically subsequent system integrity (SI:H): the damage does not stay in the gateway, it is carried through to whatever sits behind it.

Forging the verdict, not the factor

Of the four, the one worth sitting with is 121637, and not because of its score — it is the lowest — but because of what it describes. The original wording says the attacker can "forge the authentication result and transaction identifier in the request body". Forge the result: not the code the user types, but the answer the gateway sends back saying whether that attempt passed.

A second factor works like a chain of custody: someone asks, someone checks, someone answers. What gets audited and bought is almost always the check — which method, which algorithm, push or TOTP or passkey — and what gets taken for granted is the transport of the answer. In these four records the transport is precisely what is broken. We wrote about a variant of this when a vendor's own mitigation was to remove your second factor: there the quick way to close a flaw ran through switching the factor off; here the factor stays in place and what can answer on its behalf is the network stretch.

The piece you install once

An authentication gateway is the bridge between an MFA service that lives outside and the directories that live inside: LDAP, Active Directory, RADIUS, ADFS. We have already written about this kind of component, on the occasion of the fibre switch that belongs to nobody, so here we leave it at one line: it gets installed during the rollout, it works, and nobody looks at it again.

And it is not one process, it is four. WatchGuard's own documentation describes the gateway as four services — Gateway, RADIUS, LDAP and ADFS — listening on TCP ports 9000, 9001, 9002 and 9003. That explains the wording of 121640, which talks about replaying a legitimate request "between AuthPoint Gateway components": there is an internal conversation between those pieces, and that conversation travels too.

The affected version range says it plainly: 1.0 through 7.6.0. The product's entire life. Anyone who set up the gateway five years ago and has not touched it since is in range by definition. And this is where it stops being one vendor's news and becomes an inventory question: do you know which machine yours runs on, which version it is, and what it talks to?

When not to panic (and why you update anyway)

This is the good case. The vendor found them, documented them with precise descriptions, assigned its own CVEs, shipped the fix and put it all in a single version. None is exploited. And three of the four need somebody positioned inside, between your gateway and your domain controllers. If somebody is already there, AuthPoint is not your most urgent problem.

That said: "somebody inside the internal network" is precisely the attacker who exists. It is the compromised laptop of a salesperson, the supplier with a permanent tunnel, the printer nobody segmented, the server running an old application on the same VLAN as the domain controllers. Treating that stretch as safe because it is internal is the assumption that a Zero Trust approach is there to remove, and these four records are a clean example of what keeping it costs. We saw it from the other side when we explained that the site-to-site tunnel has nobody to ask for a second factor, and it points the same way that your identity provider is not just another application.

There is one more field almost nobody looks at, and here it is worth more than the four scores put together. In the block CISA adds to these records, the Automatable metric — whether reconnaissance and exploitation can be automated across many targets — reads yes on 121639 alone, and no on the other three. It is the same one that needed no preconditions. That pairing, AT:N and Automatable: yes, is what orders your afternoon: that is the one somebody can go looking for at scale, and the other three are for whoever has already picked your company.

What we would do this week

Points three and four are the ones that actually change the risk, and the only ones updating does not solve. They are the work of network segmentation and Zero Trust, they get done once, and they hold for the next advisory — which will come from a different vendor and describe a different path between two of your own pieces.

WatchGuard has done its part: it looked, it found, it documented, it shipped 7.6.0. The part left on this side is duller and no patch closes it: knowing how many components like this one you have had running for years on a stretch you take to be safe, and which of them is answering right now on another one's behalf.

Sources. Consulted on 5 November 2026. The four records — literal descriptions, CVSS v4 scores and vectors, CWE identifiers, affected version range (1.0 through 7.6.0), publication date (4 November 2026, 14:44 UTC) and credit to "WatchGuard AI Security Research" — come from the official CVE records, assigned by WatchGuard as CNA and retrieved through the CVE Program API: CVE-2026-121637 (8.9 · CWE-345 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N), CVE-2026-121638 (9.1 · CWE-295), CVE-2026-121639 (9.2 · CWE-252, CWE-287 and CWE-306) and CVE-2026-121640 (9.1 · CWE-294). The Automatable metric (yes on 121639, no on the other three) comes from the block CISA adds to those same records. The per-deployment scope (LDAP, RADIUS, ADFS, Active Directory) comes from each record's configurations field. Advisory AV26-1125 from the Canadian Centre for Cyber Security, dated 4 November 2026, covers the same set and places the affected product at "prior to 7.6.0". The meaning of AT:P and AT:N ("Attack Requirements") and of the subsequent-system metrics SI and SA come from the FIRST CVSS v4.0 specification. That none of the four is recorded as exploited is, as of 5 November, what the records themselves show plus the absence of these CVEs from CISA's KEV catalogue; it is not a guarantee about the future. The description of what the AuthPoint Gateway is, its breakdown into four services — Gateway, RADIUS, LDAP and ADFS — and TCP ports 9000 to 9003 come from WatchGuard's "About Gateways" documentation. The examples of who shares a segment are ours — from our own managed networking and security work — and are not backed by those sources. The photograph in the social image is "Krone LSA-PLUS Patch Panel", by Dennis van Zuijlekom, CC BY-SA 2.0 via Wikimedia Commons; it is cropped to remove the original's black frame.