CVE-2026-78612: CWE-502 in WatchGuard Dimension

WatchGuard Dimension version 2.0 contains an authenticated SQL injection vulnerability (CWE-502) in its scheduled report feature. An attacker with report administration permissions can exploit this flaw by sending specially crafted requests, resulting in arbitrary command execution with the privileges of the Dimension WebUI process user. This vulnerability does not require user interaction and has a network attack vector with low attack complexity. The vulnerability impacts confidentiality, integrity, and availability with high impact metrics. No official patch or remediation guidance has been provided by the vendor at this time.

Successful exploitation allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user. This can lead to full compromise of the affected system's web interface process, potentially allowing unauthorized access, data manipulation, or disruption of service. The vulnerability has a high CVSS score of 8.6, reflecting significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict report administration permissions to trusted users only and monitor for suspicious activity related to scheduled reports. Avoid exposing the Dimension WebUI to untrusted networks.