Watchguard Dimension
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Watchguard Dimension.
By the Year
In 2026 there have been 17 vulnerabilities in Watchguard Dimension with an average score of 6.6 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 17 | 6.60 |
It may take a day or so for new Dimension vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Watchguard Dimension Security Vulnerabilities
WatchGuard Dimension XSS in Trusted CA Config
CVE-2026-78616
4.8 - Medium
- August 27, 2026
A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate.
XSS
WatchGuard Dimension XSS in Historical Data Feature (Authenticated Admin)
CVE-2026-78195
- August 27, 2026
SSRF in WatchGuard Dimension Email Server Test Config
CVE-2026-78498
5.1 - Medium
- August 27, 2026
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
SSRF
WatchGuard Dimension Auth SQLi in Scheduled Report Arbitrary Cmd Exec
CVE-2026-78612
8.6 - High
- August 27, 2026
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.
Marshaling, Unmarshaling
WatchGuard Dimension DB SSRF Enables Network Service Enumeration
CVE-2026-78500
5.1 - Medium
- August 27, 2026
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
Observable Timing Discrepancy
WatchGuard Dimension Auth Bypass: Admin Triggers Multiple Ops via Request
CVE-2026-78618
6.9 - Medium
- August 27, 2026
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.
Authorization
WatchGuard Dimension Login Lacks Default Rate-Limiting; Brute-Force Risk
CVE-2026-78617
6.3 - Medium
- August 27, 2026
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.
Side Channel Attack
WatchGuard Dimension Reflected XSS in Report Detail URL
CVE-2026-78615
4.6 - Medium
- August 27, 2026
A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.
XSS
WatchGuard Dimension Auth SQLi Leads to Local Cmd Exec via Audit Reports
CVE-2026-78614
8.6 - High
- August 27, 2026
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.
Marshaling, Unmarshaling
WatchGuard Dimension Auth SQLi in Log Viewer Enables Arbitrary Cmd Exec
CVE-2026-78613
8.6 - High
- August 27, 2026
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.
SQL Injection
WatchGuard Dimension WebUI CSRF Passphrase Change
CVE-2026-78610
8.4 - High
- August 27, 2026
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.
Session Riding
WatchGuard Dimension: Denial-of-Service via TCP SYN Flood to Log Listener
CVE-2026-13108
8.7 - High
- August 27, 2026
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.
Resource Exhaustion
WatchGuard Dimension FTP Server SSRF Exposes Adjacent Services
CVE-2026-78499
5.1 - Medium
- August 27, 2026
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
SSRF
WatchGuard Dimension SSRF Enumerates Adjacent Network Services
CVE-2026-78495
5.3 - Medium
- August 27, 2026
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
SSRF
WatchGuard Dimension Log Exposes Session ID for Admin Takeover
CVE-2026-78174
9.3 - Critical
- August 27, 2026
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.
Information Disclosure
WatchGuard Dim Auth Admin Lock/Unlock Bypass
CVE-2026-78103
5.1 - Medium
- August 27, 2026
WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first completing the UI unlock step. This allows an authenticated read-write administrator session to bypass the intended editing workflow and overwrite configuration changes being made by another concurrent administrator session.
Improper Enforcement of Behavioral Workflow
WatchGuard Dimension XSS via Task Scheduling Field Injection
CVE-2026-78047
5.1 - Medium
- August 27, 2026
A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Watchguard Dimension or by Watchguard? Click the Watch button to subscribe.
