WatchGuard AuthPoint 7.5.1 Fixes LDAP Authentication Bypass
Tech GuruQuick Answer
WatchGuard AuthPoint Authentication Gateway 7.5.1 fixes CVE-2026-95676 in LDAP Sync first-factor authentication. Affected releases start at 4.2.2 and precede 7.5.1. Under non-default operating conditions, password verification can be bypassed, but WatchGuard explicitly says additional authentication factors still apply. Do not describe this as a complete MFA bypass.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory WatchGuard AuthPoint Authentication Gateway 4.2.2 through releases before 7.5.1 when configured to synchronize users from an LDAP source, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Source recheck: October 2, 2026 UTC, against WatchGuard PSIRT. Gateway behavior and the undisclosed non-default conditions were not independently tested.
Scope And Authority
| Product scope | WatchGuard AuthPoint Authentication Gateway 4.2.2 through releases before 7.5.1 when configured to synchronize users from an LDAP source |
|---|---|
| Advisory | CVE-2026-95676 |
| CVE | CVE-2026-95676 |
| Authoritative release date | 2026-09-23 12:52:04.902 UTC |
| Authority revision date | 2026-09-23 15:24:54.616 UTC |
| Affected versions | WatchGuard AuthPoint Authentication Gateway 4.2.2 through releases before 7.5.1 when configured to synchronize users from an LDAP source |
| Fixed version | WatchGuard AuthPoint Authentication Gateway 7.5.1 |
| CVSS base score | 7.4 (CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | WatchGuard is not aware of exploitation in the wild; no exploitation claim is inferred. |
What Changed
The vendor does not publicly spell out the non-default conditions in this notice. Check the gateway version and LDAP synchronization role, preserve existing additional-factor requirements, and obtain deployment-specific guidance from WatchGuard where applicability is uncertain. WatchGuard says it is not aware of exploitation in the wild; that is a vendor knowledge statement, not proof that no attempt has occurred.
What To Validate Now
- Inventory. Record each gateway version, LDAP source, synchronization configuration, dependent authentication resources, redundancy and the policies enforcing additional factors.
- Establish applicability. Compare each deployment with the authority's affected-version statement: WatchGuard AuthPoint Authentication Gateway 4.2.2 through releases before 7.5.1 when configured to synchronize users from an LDAP source Do not infer applicability from product family or severity alone.
- Remediate. Apply WatchGuard AuthPoint Authentication Gateway 7.5.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Use synthetic accounts and a controlled test resource to check legitimate authentication, rejection of incorrect passwords and continued additional-factor enforcement. Coordinate gateway maintenance to avoid locking out users; do not disable MFA or disrupt LDAP to imitate undisclosed attack conditions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
