CVE-2026-78616: CWE-79 in WatchGuard Dimension

This vulnerability is a stored XSS issue (CWE-79) in WatchGuard Dimension version 2.0. An authenticated administrator can exploit the Trusted CA certificate configuration interface by saving a maliciously crafted certificate, which results in arbitrary JavaScript execution in the context of another authenticated administrator's web session. This could potentially lead to session hijacking or other web-based attacks within the administrative interface.

An attacker with authenticated administrator access can execute arbitrary JavaScript in the browsers of other authenticated administrators. This may allow the attacker to perform actions on behalf of other administrators or steal sensitive information accessible through the administrative interface. The impact is limited by the requirement for authenticated administrator privileges and user interaction (UI required).

No official patch or remediation guidance is currently available from WatchGuard. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit administrator access to trusted personnel and monitor for suspicious activity related to certificate management.