WatchGuard Dimension CVE-2026-78613

Exploitation requires an authenticated session with report administration permissions within the WatchGuard Dimension WebUI - unauthenticated users cannot trigger this vulnerability under any configuration. The log viewer feature must be reachable by the attacker's session, and the attack is network-based (AV:N), so the attacker does not need local or adjacent-network access to the host. No additional non-default configuration or specific platform version is confirmed as required beyond holding the report administration role. The primary limiting factor is credential possession: an attacker must first obtain or compromise a report administration account, making credential hygiene and MFA on admin accounts the most impactful defensive control.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately captures both the severity of the impact and the meaningful privilege barrier. The PR:H rating is the critical limiting factor: only accounts with report administration permissions can trigger this vulnerability, which substantially narrows the exposed population compared to unauthenticated or low-privilege flaws. Attack complexity is low (AC:L, AT:N), meaning no special race conditions or prerequisites beyond credentials are needed. No EPSS score was provided, and the vulnerability is neither in CISA KEV nor associated with a known public POC, suggesting no widespread opportunistic exploitation at time of analysis. The real-world priority depends heavily on whether Dimension WebUI is internet-exposed and how tightly report administration roles are controlled - environments with shared or weakly protected admin credentials face materially higher risk than those with strict role governance.

An attacker who has obtained report administration credentials - through phishing, credential stuffing, or insider access - authenticates to the WatchGuard Dimension WebUI over the network. They submit a specially crafted request to the log viewer endpoint containing SQL injection payloads designed to escape the query context and invoke a database-level OS command execution mechanism. The injected command runs as the Dimension WebUI process user, granting the attacker a foothold on the underlying system with the privileges of that service account.