CVE-2026-78614: CWE-502 in WatchGuard Dimension

WatchGuard Dimension version 2.0 contains an authenticated SQL injection vulnerability (CWE-502) in its audit report feature. An attacker with report administration permissions can exploit this flaw by sending specially crafted requests to achieve arbitrary command execution under the privileges of the Dimension WebUI process user. This vulnerability requires authentication and elevated privileges within the application. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation allows an authenticated user with report administration permissions to execute arbitrary commands on the system with the privileges of the Dimension WebUI process user. This could lead to unauthorized system control or data compromise within the affected environment. The vulnerability does not require user interaction beyond authentication and has a high CVSS score reflecting significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict report administration permissions to trusted users only and monitor for suspicious activity related to the audit report feature. Avoid exposing the Dimension WebUI to untrusted networks to reduce risk.