CVE-2026-95676 Overview
CVE-2026-95676 is an authentication bypass vulnerability in the WatchGuard AuthPoint Gateway. The flaw resides in the Lightweight Directory Access Protocol (LDAP) Sync first-factor authentication path. A remote attacker can bypass single-factor password verification under non-default operating conditions. Additional authentication factors configured on the gateway still apply, limiting exploitation to environments relying on password-only verification through the affected path. The vulnerability is classified under [CWE-287] Improper Authentication.
Critical Impact
Remote attackers can bypass first-factor password verification on WatchGuard AuthPoint Gateway LDAP Sync deployments configured in non-default modes, undermining single-factor authentication assumptions.
Affected Products
- WatchGuard AuthPoint Gateway (LDAP Sync first-factor authentication component)
Discovery Timeline
- 2026-09-23 - CVE-2026-95676 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-95676
Vulnerability Analysis
The WatchGuard AuthPoint Gateway brokers authentication requests between clients and backend directory services. The LDAP Sync feature performs first-factor password verification against a synchronized directory. The vulnerable code path fails to enforce authentication correctly when the gateway operates outside its default configuration. An attacker can submit an authentication request that the gateway accepts as valid without a successful password check. The advisory notes that any additional authentication factors, such as one-time passwords or push approvals, continue to gate access.
Root Cause
The root cause is improper authentication logic in the LDAP Sync first-factor verification routine. Under specific non-default configurations, the gateway does not require a successful password validation before treating the first factor as satisfied. This aligns with [CWE-287], where the software fails to verify identity claims with sufficient confidence.
Attack Vector
The attack vector is network-based and does not require prior authentication. An attacker must reach the AuthPoint Gateway service and target a deployment configured in the vulnerable non-default mode. Successful exploitation weakens password-based first-factor protection but does not defeat multifactor policies where secondary factors are enforced. Refer to the WatchGuard CVE-2026-95676 Advisory for configuration specifics.
No public proof-of-concept code is available. See the vendor advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-95676
Indicators of Compromise
- Successful authentication events in AuthPoint Gateway logs that lack a corresponding LDAP bind or password validation entry.
- Repeated first-factor authentication attempts from the same source address with abnormal success ratios.
- Authentication events originating from unexpected geographic locations or IP ranges against AuthPoint Gateway.
Detection Strategies
- Correlate AuthPoint Gateway authentication logs with backend directory server bind logs to identify successes without matching LDAP verification.
- Baseline expected first-factor authentication behavior and alert on deviations, such as authentications missing password validation timestamps.
- Monitor for accounts that authenticate successfully at the first factor but fail or skip subsequent multifactor challenges.
Monitoring Recommendations
- Forward AuthPoint Gateway and directory service logs to a centralized analytics platform for correlation.
- Enable verbose authentication logging on the gateway to capture the full authentication decision path.
- Track configuration changes to the LDAP Sync module and alert on transitions away from the vendor-recommended default settings.
How to Mitigate CVE-2026-95676
Immediate Actions Required
- Review AuthPoint Gateway configuration and confirm whether LDAP Sync first-factor authentication runs in the vulnerable non-default mode described in the vendor advisory.
- Apply the fixed version published in the WatchGuard CVE-2026-95676 Advisory as soon as it is available.
- Ensure that additional authentication factors are enforced for all users authenticating through AuthPoint Gateway.
- Audit recent authentication logs for signs of first-factor bypass activity.
Patch Information
WatchGuard has published advisory information at WatchGuard CVE-2026-95676 Advisory. Administrators should consult the advisory for affected versions and the corresponding fixed release, then schedule an upgrade following change management procedures.
Workarounds
- Revert the AuthPoint Gateway LDAP Sync configuration to the vendor's default operating mode until the patch is applied.
- Enforce mandatory multifactor authentication on all identity policies that depend on AuthPoint Gateway.
- Restrict network reachability to the AuthPoint Gateway management and authentication interfaces to trusted source ranges.
- Rotate credentials for privileged accounts that authenticated through the gateway during the exposure window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
