Threat database

A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.

CVE-2026-78616 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration. It allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's browser by saving a specially crafted certificate. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS score is 4.8, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor yet.

CVE-2026-78498 is a server-side request forgery (SSRF) vulnerability in WatchGuard Dimension's Email Server Test configuration. It allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 score is 5.1, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-78612 is an authenticated SQL injection vulnerability in WatchGuard Dimension's scheduled report feature. It allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 8.6, indicating high severity.

CVE-2026-78103 is a medium severity vulnerability in WatchGuard Dimension version 2.0. It involves a server-side configuration endpoint that does not enforce the client-side lock/unlock workflow, allowing an authenticated administrator with read-write access to bypass the intended editing workflow and overwrite configuration changes made by another concurrent administrator session.

CVE-2026-78615 is a reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page. It allows an attacker to execute arbitrary JavaScript in the browser of an authenticated user via a specially crafted URL. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 4.6, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

WatchGuard Dimension version 2.0 contains an authenticated SQL injection vulnerability in its log viewer feature. This flaw allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability is classified under CWE-89 and has a high severity score of 8.6. No official patch or remediation guidance has been provided yet.

CVE-2026-78495 is a server-side request forgery (SSRF) vulnerability in WatchGuard Dimension's Remote Backup Connection Test configuration. It allows an authenticated privileged attacker to enumerate network services on adjacent systems. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 5.3, indicating medium severity.

WatchGuard Dimension version 2.0 has a vulnerability in its web login endpoint where effective rate-limiting or account lockout is not enforced by default. This allows a remote attacker to perform automated password guessing attacks against user accounts. While an account lockout setting exists to block brute-force attempts after a defined number of failures, it is not enabled by default.

CVE-2026-78047 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature. It allows a low-privileged authenticated administrator to inject arbitrary HTML or JavaScript code into fields that are then executed in the browser session of other users. This vulnerability has a medium severity rating with a CVSS score of 5.1. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-78610 is a high-severity vulnerability in WatchGuard Dimension version 2.0 where the web UI's administrator passphrase change function lacks Cross-Site Request Forgery (CSRF) protection. This allows an attacker to trick an authenticated global administrator into changing their passphrase to a value chosen by the attacker without the administrator's consent.

CVE-2026-78499 is a server-side request forgery (SSRF) vulnerability in WatchGuard Dimension's FTP Server Test configuration. It allows an authenticated user with privileged access to enumerate network services on adjacent systems. The vulnerability has a medium severity score of 5.1 and affects version 2.0 of WatchGuard Dimension. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-78174 is a critical vulnerability in WatchGuard Dimension version 2.0 where unredacted session identifiers for logged-in users are recorded in the web UI diagnostic log. A low-privileged Dimension Administrator can access this log and extract a Super Administrator's session token while the latter is logged in, potentially allowing account takeover.

CVE-2026-78618 is a business logic flaw in WatchGuard Dimension version 2.0 that allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request. The vulnerability has a medium severity with a CVSS score of 6.9. There is no official patch or remediation level currently provided by the vendor. The flaw requires high privileges (administrator) and does not involve user interaction. No known exploits are reported in the wild.