Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-121640 is a critical-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Watchguard (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-116930
Vulnerability Data
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
A.8.29's combined programme of code review, vulnerability scanning, and penetration testing reaches CWE-294 from both SOURCE (code review can spot authentication designs lacking nonces/timestamps/replay protection) and RUNTIME (pentesting routinely attempts capture-replay of credentials and session tokens, and the weakness is observable from outside); the bounded remainder is subtle protocol-design issues that neither static review nor standard pentest reliably surfaces.
Training raises developer awareness of capture-replay risks and can influence the choice of authentication protocols that include replay protection (nonces, challenge-response), but the weakness is fundamentally an architectural/design defect that training alone does not prevent—developers remain fallible, and the strongest controls (cryptography, secure architecture) carry the primary effect.
A.8.21 requires security features for network services including authentication and encryption, which can block capture-replay during network transit, but the clause does not specifically mandate replay-resistant authentication protocols and the actual protocol design lives in other controls (A.8.24 cryptography, A.8.28 secure coding); encryption alone does not stop replay of an encrypted message, so the weakness remains exploitable where the authentication protocol lacks nonces/timestamps.
A.8.28's secure design/architecture and threat modelling guidance (planning item g) and its prohibition on insecure design techniques can catch capture-replay during design, but the clause mandates a fallible practice whose effect depends on developer rigour, so only a minority of instances are prevented.
A.8.30 carries its effect through the secure-development practices its contract requires of the supplier (8.25–8.29), and CWE-294 is an ordinary software design weakness that those practices address (authentication design using nonces, timestamps, challenge-response); the clause reduces but does not eliminate the weakness, sitting at the same rung as the CWE-134 anchor.