WatchGuard Dimension CVE-2026-78047

Exploitation requires a valid low-privileged authenticated administrator account on the target WatchGuard Dimension instance - unauthenticated network access alone is insufficient and cannot trigger this vulnerability. The attacker must specifically have write access to the task scheduling feature within Dimension. Beyond injection, actual impact is conditioned on at least one other user visiting or refreshing the task scheduling interface after the payload is stored; if no second user accesses that page, the stored payload yields no cross-session impact. The CVSS 4.0 UI:P metric independently confirms this passive victim-interaction requirement. Single-administrator Dimension deployments effectively eliminate the cross-user exploitation path. Risk is further bounded by network segmentation: if the Dimension management interface is restricted to internal networks or VPN, the attacker must already have internal network access in addition to valid credentials.

The CVSS 4.0 base score of 5.1 (Medium) accurately captures the key constraints: network-accessible delivery (AV:N), low complexity (AC:L), low-privilege authenticated attacker (PR:L), and a passive victim interaction requirement (UI:P), with impact scoped to the subsequent system (SC:L/SI:L/SA:L) rather than direct server compromise. No EPSS data, CISA KEV listing, or public proof-of-concept code has been identified, which limits independent exploitation-probability assessment. Despite the moderate composite score, the stored XSS pattern meaningfully amplifies practical risk in multi-administrator Dimension deployments: a compromised or rogue low-privileged admin account can persist a payload that silently targets higher-privileged sessions, enabling credential theft or privilege escalation within the management plane. In single-administrator deployments or those with strict role segregation, the cross-user impact vector is substantially reduced. The absence of a confirmed fixed version in available intelligence is a gap defenders should resolve via the vendor advisory before assessing patch urgency.

A low-privileged authenticated administrator with access to WatchGuard Dimension injects a JavaScript payload - such as a script that exfiltrates document.cookie to an attacker-controlled endpoint - into a task name or description field within the scheduling interface. When a higher-privileged Dimension administrator subsequently views the task scheduling page during normal operations, the stored payload executes transparently in their browser, sending their session token to the attacker and enabling full session hijacking. No public proof-of-concept has been identified, though the technique is well-understood and requires only standard web exploitation knowledge given valid credentials.