WatchGuard Dimension CVE-2026-78616

Exploitation requires an authenticated administrator account with write access to the Trusted CA certificate configuration in WatchGuard Dimension - confirmed as a high-privilege prerequisite (PR:H) in the CVSS 4.0 vector. A second authenticated administrator must subsequently view the certificate configuration page to trigger payload execution (UI:P). Exploitation is therefore limited to multi-administrator deployments where one admin account is either compromised externally or acting maliciously. Single-administrator deployments are not practically at risk from this specific path, as a fully compromised admin account already grants direct console access. Limiting factors include: required high-privilege authentication to plant the payload, required passive victim interaction for execution, and network-accessible attack vector scoped exclusively to the Dimension management interface.

The CVSS 4.0 score of 4.8 with PR:H and UI:P accurately represents the constrained real-world risk: the attacker must already hold a valid high-privilege administrator account within Dimension to write the malicious certificate, and a separate victim administrator must subsequently view the affected page. This is fundamentally an intra-admin privilege abuse or insider threat vector rather than an external attack path. No EPSS data was provided and there is no CISA KEV listing, consistent with the absence of known active exploitation. The VC:L/VI:L impact metrics and zero availability impact (VA:N) further bound the realistic harm to session manipulation or limited data access within the management console. Overall, this vulnerability warrants remediation but should be deprioritized relative to externally exploitable or unauthenticated flaws - the prerequisite of an already-compromised or rogue admin account significantly limits the attack population.

A malicious insider or attacker who has compromised an administrator account logs into WatchGuard Dimension, navigates to the Trusted CA certificate configuration, and saves a certificate with an embedded JavaScript payload. When a second authenticated administrator subsequently views the certificate management page, the stored script executes silently in their browser, enabling session token theft, credential harvesting, or unauthorized administrative actions performed in the context of the victim's session. No public exploit code has been identified at time of analysis.