CVE-2026-121638: WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using WatchGuard AuthPoint Gateway to communicate with local authentication providers are exposed if an attacker can obtain an on-path position between the gateway and those providers.
What does an attacker need to exploit it?
The attacker needs an on-path network position that allows them to intercept traffic between the AuthPoint Gateway and local authentication providers. No privileges or user interaction are required according to the supplied CVSS vector.
What can an attacker do if exploitation succeeds?
An attacker can intercept and modify communications between the AuthPoint Gateway and local authentication providers. The supplied CVSS vector indicates high confidentiality and integrity impact, with no availability impact.