CVE-2026-121638

CriticalCVSS 9.1/10Last modified Nov 6, 2026

Description

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.

Metrics

CVSS 4.0 9.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
WatchGuard	AuthPoint Authentication Gateway	>= 1.0, < 7.6.0

References

https://psirt.watchguard.com/CVE-2026-121638

Timeline

Published: Nov 4, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1216399.2A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with n CVE-2026-121644.4Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective per CVE-2026-1216409.1An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate re CVE-2026-121658.8The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in a CVE-2026-1216525.4Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitra CVE-2026-1216539.8SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code CVE-2026-121665.5A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser CVE-2026-1216607.5Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216617.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1216628.6Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to CVE-2026-1216638.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216648.3Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker t