WatchGuard Dimension CVE-2026-78615

The victim must be authenticated to WatchGuard Dimension at the time of exploitation - unauthenticated users reaching the report detail page would not provide a useful attack surface since the CVSS 4.0 PR:H rating indicates high-privilege session context is required for meaningful impact. The attacker must successfully deliver the crafted URL to the authenticated user and induce active interaction (UI:A), meaning exploitation is gated on a social engineering step. The report detail page must be network-reachable from the victim's browser. No special server-side configuration is described as necessary beyond the default Dimension deployment. Exploitation is limited by the requirement for an active high-privilege session: automated or opportunistic mass exploitation is not viable.

The CVSS 4.0 score of 4.6 is modest and reflects realistic constraints: PR:H (high privileges required from the attacker's perspective, likely meaning only high-privilege victims are meaningful targets) and UI:A (active user interaction) substantially limit exploitability. No EPSS data was supplied, so exploitation probability cannot be quantified numerically. The absence of a KEV listing and lack of any reported POC further reduce urgency. The real-world risk is therefore best characterized as low-to-moderate: an attacker must identify an authenticated Dimension admin, craft a convincing phishing lure targeting the specific report detail URL parameter, and successfully deliver it. The impact is limited to session-level actions within the victim's browser (SC:L/SI:L) - credential theft, forced actions in the Dimension UI, or session token exfiltration are realistic but not system-level compromise. No conflict between CVSS metrics and description is apparent; both consistently indicate a network-delivered, interaction-dependent, low-impact XSS.

An attacker identifies a WatchGuard Dimension administrator with an active authenticated session, then crafts a Dimension report detail page URL containing a malicious JavaScript payload in an unsanitized query parameter. The attacker delivers the URL via spear-phishing email or an injected link in another communication channel; when the admin clicks the link while authenticated, the payload executes in their browser, potentially harvesting the session cookie or performing actions within Dimension on the attacker's behalf. No public POC is known at time of analysis.