WatchGuard Dimension vulnerabilities

Latest WatchGuard Dimension CVEs

Newest publication first

1. CVE-2026-86135 Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service

   Published 2026-09-08

   High·CVSS 7.0 EPSS 0.25%

   A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.

2. CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

   Published 2026-08-27

   Medium·CVSS 5.1 EPSS 0.44%

   A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.

3. CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

   Published 2026-08-27

   Medium·CVSS 4.6 EPSS 0.47%

   A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.

4. CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration

   Published 2026-08-27

   Medium·CVSS 4.8 EPSS 0.30%

   A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate.

5. CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

   Published 2026-08-27

   Medium·CVSS 6.3 EPSS 0.42%

   WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked af...

6. CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

   Published 2026-08-27

   Medium·CVSS 5.1 EPSS 0.44%

   A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user.

7. CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test

   Published 2026-08-27

   Medium·CVSS 5.3 EPSS 0.39%

   A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.

8. CVE-2026-78612 Dimension SQL Injection in Scheduled Report

   Published 2026-08-27

   High·CVSS 8.6 EPSS 0.71%

   WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted r...

9. CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

   Published 2026-08-27

   High·CVSS 8.4 EPSS 0.23%

   WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen...

10. CVE-2026-78613 Dimension SQL Injection in Log Viewer

    Published 2026-08-27

    High·CVSS 8.6 EPSS 0.62%

    WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted request...

11. CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability

    Published 2026-08-27

    Medium·CVSS 5.1 EPSS 0.49%

    WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint wit...

12. CVE-2026-78618 Dimension Business Logic Flaw Allows Chained Backend Object Operations

    Published 2026-08-27

    Medium·CVSS 6.9 EPSS 0.43%

    A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.

13. CVE-2026-78174 WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

    Published 2026-08-27

    Critical·CVSS 9.3 EPSS 0.43%

    WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account t...

14. CVE-2026-78614 Dimension SQL Injection in Audit Report

    Published 2026-08-27

    High·CVSS 8.6 EPSS 0.71%

    WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted reque...

15. CVE-2026-78499 Dimension SSRF via FTP Server Test Connection

    Published 2026-08-27

    Medium·CVSS 5.1 EPSS 0.44%

    A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.

16. CVE-2026-78500 Dimension Blind SSRF via Database Test Connection Feature

    Published 2026-08-27

    Medium·CVSS 5.1 EPSS 0.44%

    A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.

17. CVE-2026-13108 Dimension Denial-of-Service

    Published 2026-08-27

    High·CVSS 8.7 EPSS 0.43%

    WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.