WatchGuard Dimension CVE-2026-78103

Exploitation requires an authenticated WatchGuard Dimension administrator account with read-write privileges - unauthenticated access is not sufficient. The attack is only impactful when a second concurrent administrator session exists and is actively making configuration changes, making this a race-condition-style scenario that depends on organizational deployment patterns (multiple concurrent admins). The flaw is triggered by direct API interaction with the configuration endpoint, bypassing the client-enforced lock/unlock UI step. Limiting factors include: the requirement for valid admin credentials (PR:H), the need for concurrent multi-admin usage to cause observable harm, and the fact that no confidentiality or availability impact results - only configuration integrity is at risk.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:H/UI:N) accurately reflects the constrained impact of this flaw. The network attack vector and low complexity are offset heavily by the PR:H requirement - exploitation demands valid, authenticated administrator credentials, which substantially limits the threat surface. Impact is limited to low integrity (VI:L) with no confidentiality or availability consequence, consistent with a configuration-overwrite scenario rather than code execution. No KEV listing exists and no public exploit code has been identified, placing this firmly in the category of a real-but-low-urgency finding. The primary real-world risk is operational: concurrent administrator sessions in larger WatchGuard environments could have configuration changes silently clobbered, potentially introducing policy gaps or inconsistencies. This is a meaningful integrity concern for organizations using Dimension in multi-admin deployments, but it does not represent a path to system compromise or data exfiltration.

An authenticated administrator with an active read-write session on WatchGuard Dimension identifies the configuration submission API endpoint through browser developer tools or API documentation. While a second administrator is mid-session making legitimate configuration changes, the first administrator submits a direct HTTP request to the endpoint - bypassing the UI lock check - overwriting the second administrator's in-progress changes without warning. No exploit code is publicly available and this scenario requires valid admin credentials.