CVE-2026-78047: CWE-79 in WatchGuard Dimension

This vulnerability involves a stored XSS flaw (CWE-79) in the task scheduling component of WatchGuard Dimension version 2.0. An attacker with low-privileged administrator access can inject arbitrary HTML or JavaScript into task scheduling fields. When other users access these fields, the injected code executes in their browser context, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack or user interaction required beyond authentication, and limited scope impact.

The impact is limited to the execution of arbitrary scripts in the browsers of users who view the injected content. This can lead to theft of session tokens, unauthorized actions performed in the context of the victim user, or other client-side attacks. Since the attacker requires low-privileged authenticated administrator access to inject the payload, the risk is somewhat mitigated by authentication requirements. There is no indication of remote unauthenticated exploitation or direct system compromise.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict low-privileged administrator access to trusted users only and consider monitoring for suspicious activity related to task scheduling fields. Avoid using browsers or sessions that access the affected fields from untrusted environments.