CVE-2026-78047: CWE-79 in WatchGuard Dimension

This vulnerability involves stored XSS in the task scheduling feature of WatchGuard Dimension version 2.0. An authenticated administrator with low privileges can inject malicious HTML or JavaScript into certain fields. When other users view these fields, the injected code executes in their browsers, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack or user interaction required beyond authentication, and limited scope and impact confined to confidentiality and integrity with low severity.

The impact is limited to the execution of arbitrary script code in the browsers of users who view the injected content. This can lead to theft of session tokens, defacement, or other client-side attacks within the context of the affected application. Since exploitation requires authenticated low-privileged administrator access, the risk is moderated but still significant within the user base.

No official fix or patch has been announced by WatchGuard as of the publication date. Users should monitor vendor advisories for updates. In the meantime, restricting administrator privileges to trusted users and limiting access to the task scheduling feature can reduce risk. Applying web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation.