CVE-2026-121638

{
  "etk_id": "ETK-2026-3510",
  "cve_id": "CVE-2026-121638",
  "display_id": "CVE-2026-121638",
  "ghsa_id": "GHSA-97r6-h6fj-p27h",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper certificate validation in AuthPoint Authentication Gateway",
  "summary": "AuthPoint Authentication Gateway versions before 7.6.0 improperly validate certificates for communications with local authentication providers. An attacker positioned on the network path may intercept and modify those communications. Exploitation requires an on-path network position between the gateway and a local authentication provider.",
  "mitigation": "Upgrade AuthPoint Authentication Gateway to version 7.6.0 or later. Restrict and monitor network paths between the gateway and local authentication providers until the upgrade is complete.",
  "vendor": "WatchGuard",
  "product": "AuthPoint Authentication Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0, < 7.6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.6.0"
      ],
      "package_name": "AuthPoint Authentication Gateway",
      "purl": null
    }
  ],
  "cwes": [
    295
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.841438716666667,
  "t0_at": "2026-11-04T14:44:14.541000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T14:44:14.541000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T14:44:14.541000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121638"
    }
  }
}