WatchGuard Dimension CVE-2026-78610

The victim must be authenticated to WatchGuard Dimension as a global administrator at the time of the attack - lower-privileged Dimension accounts are not sufficient for the attacker to achieve administrative takeover. The attacker must induce that specific administrator to visit a crafted page or link while their Dimension session is active; this social-engineering step is the primary limiting factor against opportunistic mass exploitation. No non-default Dimension configuration is required - the vulnerability is present in the default Web UI passphrase change handler across all versions. Exploitation is further limited by the fact that only the targeted administrator's passphrase is changed per forged request, and the administrator may notice the lockout and trigger an incident response before the attacker can fully leverage the access.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H) reflects high CIA impact alongside meaningful preconditions: the target must be an actively authenticated global administrator who interacts with attacker-controlled content. EPSS data is absent from available intelligence, so exploitation probability cannot be independently quantified from that signal. The vulnerability does not appear in CISA KEV, and no public exploit code has been identified - these signals together suggest no confirmed widespread or opportunistic exploitation at time of analysis. The vendor-supplied PR:H metric warrants scrutiny: in standard CVSS 4.0 methodology, PR reflects the attacker's own required privileges, not the victim's; an independent assessment yields PR:N, with the global-admin victim constraint better captured as a UI and exploitation-conditions qualifier. This distinction matters for risk calibration - the attack is social-engineering-dependent and conditional on admin session state, not a persistent always-on exposure. The business impact of a successful exploit is nevertheless severe, as Dimension controls security policy for downstream WatchGuard appliances; compromise of the platform is equivalent to compromise of the organization's network perimeter management layer. Organizations should assess whether Dimension's Web UI is reachable from general-purpose workstations used for routine internet browsing.

An attacker sends a global administrator a phishing email containing a link to an attacker-controlled web page. When the administrator visits that page while an active Dimension session exists in another browser tab, hidden JavaScript on the attacker's page automatically submits a form targeting the Dimension passphrase change endpoint, resetting the administrator's passphrase to an attacker-chosen value. The attacker then authenticates to Dimension with the new passphrase, gaining full administrative control over the platform and all managed WatchGuard appliances.