CVE-2026-121639
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-121639 is a critical-severity Unchecked Return Value (CWE-252) vulnerability in Watchguard (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-116932
Vulnerability Data
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Access enforcement requires prior authentication before any authorization decision for critical functions.
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Developer testing and code evaluation can discover instances where return values are ignored.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
A.8.5 mandates that authentication be in place to substantiate claimed identity when access to systems, applications and services is granted, and CWE-306 is the absence of authentication for critical functions; applying A.8.5 where it was not applied before requires adding authentication, so the weakness stops being present with no remainder, analogous to A.8.24 -> CWE-311 = full.
Security testing in development and acceptance can detect missing return-value checks.
A.8.3 mandates authentication for access to information and associated assets (explicit in the dynamic access management section: 'requiring authentication, appropriate credentials or a certificate'), so implementing it where it was not applied before adds authentication to critical functions that lacked it, removing most CWE-306 instances; the remainder is nameable — secondary channels that bypass the primary authentication path, debug/UART ports, and protocol-level gaps in OT/embedded systems where access restriction is enforced at a different layer than the clause reaches.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
Training developers in defensive programming and error-handling practices reduces instances of unchecked return values, but the practice is fallible and a different clause (e.g., A.8.28 secure coding, A.8.29 security testing) carries the stronger effect, matching the A.6.3 vs CWE-598 and A.8.28 vs CWE-79 anchors.
Network controls (firewalls, network authentication, filtering, segmentation) can block external or unauthorized network access to an unauthenticated critical function, but the missing authentication remains in the application and is still exploitable by anyone who reaches the service path — including internal users, anyone bypassing the firewall, or cases where the function is intentionally network-exposed.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over our cross-walk; rows rated `none` are excluded, and each rule says how its mapping was checked.
Definition changed on 29 October 2026. Until then this section listed every rule rated above none, partial included. From that date it lists rules whose mapping is rated full or mostly and checked at llm_unverified or higher; partial mappings show when you ask.
Oracle Linux 8 (2 partial rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. blocks CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. blocks CWE-306
RHEL 7 (1 rule, 1 more partial)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. blocks CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. blocks CWE-306
RHEL 8 (1 rule, 1 more partial)
- V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. blocks CWE-306