AuthPoint Gateway EUVD-2026-85287

Exploitation requires the AuthPoint Authentication Gateway to be configured with LDAP Sync as the first-factor authentication method - explicitly described as a NON-DEFAULT operating condition - so default-configured deployments are not affected. It further requires the attack requirement modeled as AT:P and some user/victim interaction (UI:A). The bypass affects ONLY the single first-factor password verification; any additional configured authentication factors (MFA) still apply and continue to protect the account, so full compromise is not achieved on multi-factor-enforced deployments. Limiting factors: dependency on the specific LDAP Sync first-factor configuration, surviving MFA factors, and a required attack precondition/user action.

This is a vendor-self-reported (WatchGuard PSIRT) authentication weakness rated CVSS 4.0 7.4 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N. The network vector and unauthenticated attacker (PR:N) are the aggravating signals, but two strong mitigating signals sit inside the same vector and description: AT:P indicates a specific attack requirement must be met, UI:A implies reliance on victim/user action, and the description explicitly limits impact to 'non-default operating conditions' where the AuthPoint Gateway is configured for LDAP Sync first-factor authentication. Critically, the flaw only bypasses the SINGLE first factor (password verification) - the description states 'additional authentication factors still apply,' so on properly configured MFA deployments this is a partial bypass, not a full account takeover. There is no EPSS score, no CISA KEV listing, and no public POC provided, so there is no public exploit identified at time of analysis. Net assessment: a legitimately serious authentication defect in a security product, but its real-world priority is tempered by the non-default configuration requirement and surviving MFA factors - treat as important-to-patch rather than an emergency, and verify whether affected deployments actually run LDAP Sync first-factor mode.

An organization runs the WatchGuard AuthPoint Gateway configured (non-default) to use LDAP Sync for first-factor authentication. A remote attacker who knows or targets a valid username exercises the flawed LDAP Sync first-factor path to have the password check improperly satisfied, bypassing single-factor password verification. Where additional MFA factors are enforced the attacker is still blocked at the second factor; no public exploit code is currently identified.