CVE-2026-95676

Executive Summary

CVE-2026-95676 is a missing/improper authentication vulnerability (CWE-287) in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication. Under non-default operating conditions, a remote attacker can bypass single-factor password verification. Multi-factor authentication components remain in force, meaning the bypass does not fully negate the authentication stack, but it weakens the first authentication layer for organizations that rely on password-based first-factor validation combined with LDAP Sync. No CVSS score, EPSS score, patch, PoC, or exploit code is currently available, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in the LDAP Sync authentication path of the WatchGuard AuthPoint Gateway. AuthPoint is WatchGuard's cloud-based identity and MFA platform; the Gateway component acts as the on-premises bridge between the cloud service and directory infrastructure such as LDAP. LDAP Sync is the mechanism by which user identities, group memberships, and directory attributes are synchronized from an LDAP directory into the AuthPoint ecosystem so that authentication decisions can be made against authoritative identity data.

Per the NVD description, the flaw is classified as a missing or improper authentication issue affecting the LDAP Sync first-factor authentication. In a typical multi-factor flow, the first factor is something the user knows (a password) or is; the second and subsequent factors are additional proofs of identity. The description explicitly states that "additional authentication factors still apply," which bounds the impact: an attacker exploiting this flaw does not obtain a complete authentication bypass, but can skip or defeat the password-verification step of the first factor.

The critical qualifier in the advisory language is that the bypass is exploitable "under non-default operating conditions." This means the weakness is not universally reachable on every deployment. It surfaces only when the AuthPoint Gateway / LDAP Sync integration is configured outside its default state — for example, with atypical synchronization parameters, altered authentication-flow settings, or environment-specific directory conditions. The exact non-default condition is not enumerated in the available data. The attack is remote and network-reachable (the description states "remote attacker"), consistent with the Gateway's role as a network-facing authentication endpoint that receives authentication and synchronization requests.

From a code/mechanism perspective, CWE-287 (Improper Authentication) in a first-factor verification routine typically presents as one of the following classes: a missing check that a credential-validation call actually succeeded before proceeding; a logic path in which an LDAP bind or credential comparison result is not enforced; or an error-handling path that defaults to an authenticated state when the LDAP backend returns an unexpected result. Because the NVD description does not disclose the specific function, parameter, or code path involved, the precise implementation-level root cause cannot be stated without fabrication. What can be stated with confidence is the vulnerability class: an authentication decision in the LDAP Sync first-factor path fails to properly verify the supplied password, and that failure is only reachable under non-default configuration.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-95676. The following chain is therefore inferred strictly from the vulnerability class (CWE-287, improper authentication in a first-factor LDAP Sync path) and the advisory wording. It describes the attack at the vulnerability-class level and avoids asserting any specific function, endpoint, or parameter that is not present in the source data.

1. Reconnaissance / target identification. An attacker identifies an internet- or network-reachable WatchGuard AuthPoint Gateway deployment. Because the flaw is tied to LDAP Sync first-factor authentication, the relevant target is an organization that integrates AuthPoint with an LDAP directory and that operates the Gateway under the specific non-default condition referenced in the advisory. Discovery is network-based; no local access, credentials, or user interaction is implied by the description.

2. Triggering the flaw class. The attacker submits an authentication attempt against the first-factor path in a manner that exploits the missing/improper verification. In an improper-authentication vulnerability of this class, the attacker typically supplies a manipulated or invalid credential value and either causes the verification step to be skipped, or causes the LDAP-backed check to return a result that the gateway mishandles as a success. The precise trigger cannot be specified from available data; it depends on the non-default configuration state that exposes the flaw.

3. Payload/execution method. At the vulnerability-class level, the "payload" is a crafted authentication request targeting the LDAP Sync first-factor verification logic. No specific request format, parameter, or header is documented in the available intelligence, and none should be assumed.

4. Post-exploitation impact. Successful exploitation bypasses single-factor password verification. It does not bypass additional authentication factors; the NVD description is explicit that other factors still apply. As a result, the attacker's position after exploitation is that of a user who has satisfied the first factor but must still clear the remaining factor(s). The realistic outcome is a weakened authentication boundary — useful to an attacker who can also satisfy or defeat the remaining factor (for example, through MFA fatigue, device compromise, or session theft) — rather than a standalone full account takeover.

Impact Assessment

CWE-287 with a remote, unauthenticated attacker yields a meaningful but bounded impact. Because additional authentication factors remain in effect, the confidentiality and integrity impact is limited rather than total — consistent with a Low-to-Moderate severity profile. The Common Vulnerability Scoring System has not assigned an official score or vector for this CVE; the vector shown in the metadata is an estimate reflecting the network attack vector (AV:N), the configuration-dependent ("non-default") precondition (AC:H), no required privileges (PR:N), no user interaction (UI:N), and limited confidentiality/integrity impact (C:L/I:L/A:N). This estimate is informational only and should not be represented as an official score.

Affected systems are WatchGuard AuthPoint Gateway deployments that use LDAP Sync for first-factor authentication and that are operated under the specific non-default condition enabling the flaw. The blast radius is confined to identity/authentication infrastructure reachable through the gateway. Business impact includes erosion of the assurance that password-based first-factor verification provides, potential audit/compliance exposure for environments relying on single-factor-plus-LDAP verification, and an expanded attack surface for credential-based intrusion attempts. Availability is not implicated by the description. There is no evidence of exploitation in the wild, no KEV listing, and no EPSS score.

Detection Guidance

Detection is complicated by the absence of a disclosed PoC and the "non-default operating conditions" precondition; the rules below detect anomalous LDAP Sync / first-factor authentication behavior generically and should be tuned to the local deployment.

Sigma Rule

title: Potential WatchGuard AuthPoint Gateway LDAP Sync First-Factor Authentication Bypass
id: 3f9c1a7e-6b2d-4e88-9c1f-0a7d5e2b91c4
status: experimental
description: Detects anomalous or repeated first-factor authentication attempts against AuthPoint Gateway LDAP Sync that could indicate exploitation of CVE-2026-95676 (improper authentication).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95676
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: authentication
  product: watchguard
detection:
  selection_event:
    event_type:
      - 'ldap_sync_auth'
      - 'authpoint_login'
      - 'first_factor_auth'
  selection_result:
    auth_result:
      - 'success'
      - 'bypass'
  filter_known:
    src_ip|cidr:
      - '10.0.0.0/8'
  condition: selection_event and selection_result and not filter_known
falsepositives:
  - Legitimate authentication from unexpected-but-valid source ranges
  - Lab or testing environments
level: high
tags:
  - attack.t1078
  - cve.2026.95676

YARA Rule

rule CVE_2026_95676_AuthPoint_LDAP_Sync_AuthBypass
{
    meta:
        description = "Detects indicators of improper authentication in WatchGuard AuthPoint Gateway LDAP Sync components (CVE-2026-95676)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95676"
        cve = "CVE-2026-95676"

    strings:
        $a1 = "AuthPoint" ascii nocase
        $a2 = "LDAP Sync" ascii nocase
        $a3 = "first-factor" ascii nocase
        $b1 = "authpoint-gateway" ascii nocase
        $b2 = "ldap_sync" ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 50MB and
        (any of ($a*)) and
        (any of ($b*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95676 WatchGuard AuthPoint Gateway LDAP Sync first-factor authentication bypass attempt"; flow:established,to_server; http.uri; content:"ldap"; nocase; http.uri; content:"sync"; nocase; http.uri; content:"auth"; nocase; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-95676; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95676; sid:202695676; rev:1;)

Note: Because no public exploit signature exists, this rule matches on the authentication/sync URI pattern generically and will require tuning against the deployment's actual AuthPoint Gateway endpoints.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ authentication where event.action in ("ldap_sync_auth", "first_factor_auth") and event.outcome == "success" ]
  [ authentication where event.action in ("ldap_sync_auth", "first_factor_auth") and event.outcome == "success" ]
| where count() >= 3

Splunk SPL Query

index=authpoint OR index=watchguard sourcetype=authpoint:* (event_type=ldap_sync_auth OR event_type=first_factor_auth)
| stats count values(src_ip) as src_ips values(user) as users by auth_result, host
| where auth_result="success" AND count >= 5
| table host, auth_result, count, src_ips, users

Wazuh OSSEC Rule

<group name="watchguard,authpoint,cve-2026-95676,">
  <rule id="100956" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">ldap_sync_auth|first_factor_auth</field>
    <field name="auth_result">success</field>
    <description>CVE-2026-95676: Possible AuthPoint Gateway LDAP Sync first-factor authentication bypass (successful auth without expected verification)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround has been identified by any tracked source. No affected-version range has been published.

1. Immediate mitigations.

   • Restrict network access to the WatchGuard AuthPoint Gateway management/authentication interfaces to trusted networks and administrative hosts only; do not expose them broadly to the internet.
   • Review the LDAP Sync configuration and revert any non-default settings to default where operationally feasible, since the flaw is only reachable under non-default operating conditions. Engage WatchGuard support to confirm which configurations are affected.
   • Ensure multi-factor authentication is enforced for all accounts so the remaining factors continue to provide defense in depth, given that single-factor password verification can be bypassed.
   • Monitor AuthPoint and gateway logs for anomalous successful first-factor authentications.

2. Patch / upgrade steps.

   • No patch is currently available. Monitor WatchGuard's security advisories and AuthPoint Gateway release notes for an official fix, and apply it as soon as published.
   • Subscribe to WatchGuard security notifications and re-check the NVD entry for CVE-2026-95676 for updated version ranges and remediation references.

3. Long-term hardening.

   • Treat password-based first-factor authentication as a weak link and move toward MFA-everywhere / phishing-resistant authentication.
   • Enforce least-privilege and network segmentation for authentication infrastructure such as the AuthPoint Gateway and its LDAP back-end.
   • Establish continuous monitoring, log retention, and alerting for authentication anomalies, and validate that configuration baselines for directory-sync components are documented and enforced.
   • Track the CVE in vulnerability management tooling with high visibility until a patch or authoritative guidance emerges, and reassess risk whenever EPSS/CVSS values are published.

References

• NVD — CVE-2026-95676: https://nvd.nist.gov/vuln/detail/CVE-2026-95676
• WatchGuard security advisories (vendor): https://www.watchguard.com/wgrd-security-advisories
• WatchGuard AuthPoint product documentation: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/AuthPoint/authpoint_about.html
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV entry are associated with CVE-2026-95676 at the time of writing.