External risk intelligence

WatchGuard AuthPoint Gateway Authentication Service Disruption and Configuration Deletion

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-121639

The vulnerability affects a WatchGuard AuthPoint Gateway, which is an identity and authentication service. Such gateways are designed to be internet-facing or edge-accessible components to facilitate remote authentication and directory synchronization for users and services, making them highly likely to be exposed to the public internet in normal deployments.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in WatchGuard AuthPoint Gateway could allow an unauthenticated attacker to disrupt authentication services and delete critical configuration data. This impacts the availability and integrity of authentication for your organization. The main concern is confirming relevance and exposure.

Unauthenticated attackers can disrupt authentication.
Affects critical authentication and directory services.
Confirm relevance and exposure of this gateway.

Attack Path

How an attacker could exploit the issue

An attacker can target the WatchGuard AuthPoint Gateway by reaching its host over the network. Once network access is established, the attacker can interact with the gateway without needing any authentication. This interaction targets a critical function, allowing the attacker to disrupt authentication services and erase the local directory synchronization configuration.

Network access required.
Unauthenticated critical function.
Disrupted authentication, deleted configuration.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker with network access to the WatchGuard AuthPoint Gateway host could disrupt authentication services and delete the local directory synchronization configuration. This could impact the gateway's ability to perform its core function of authenticating users and synchronizing directory data, potentially leading to service outages.

Authentication services and synchronization data at risk.
Unauthenticated network access allows disruption.
Service outages and data loss may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WatchGuard AuthPoint Gateway, an identity and authentication service, is likely managed by infrastructure or platform teams. The first practical step is to confirm the internet-facing or edge accessibility of these gateways, verify their business criticality, and identify the accountable owner to plan remediation based on the assessed risk of authentication service disruption and configuration deletion.

Infrastructure or platform teams own the issue.
Verify gateway exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WatchGuard AuthPoint Gateway?

WatchGuard AuthPoint Gateway is a software component that facilitates multi-factor authentication and directory synchronization. It acts as a bridge between your organization's internal user directories and the broader AuthPoint identity ecosystem, ensuring that authentication requests are processed and synced correctly.

What does CVE-2026-121639 mean for the software?

This vulnerability is classified as Missing Authentication for Critical Function. Essentially, the software fails to verify the identity of a requester before allowing access to sensitive tasks. In this case, it lets an unauthenticated person invoke commands that stop authentication services or remove directory sync settings.

How does an attacker trigger this vulnerability?

An attacker needs network-level access to the host machine running the AuthPoint Gateway. If they can reach the gateway over the network, they can send unauthorized requests to execute the disruptive commands. Simply having access to the local network or the internet-facing IP of the host is sufficient; they do not need valid login credentials.

Is my AuthPoint Gateway at risk?

According to Halo Surface Signal, this component is often designed to be internet-facing to handle remote authentication requests, which increases the likelihood of exposure. If your gateway is accessible from the public internet, it faces a higher risk of being targeted by unauthorized parties compared to instances restricted to internal networks.

How should I respond to this threat?

The first step is to locate all instances of AuthPoint Gateway in your environment to determine which are internet-facing versus those restricted to internal segments. Once identified, work with your infrastructure or platform teams to assess the business impact of a potential authentication outage and coordinate the necessary software updates to address the missing authentication flaw.

References

psirt.watchguard.com/CVE-2026-121639

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.