CVE-2026-78610

CVE-2026-78610 is a cross-site request forgery flaw (CWE-352) in the Web UI of WatchGuard Dimension: the administrator passphrase-change action has no CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can silently submit that action. This lets the attacker set the global administrator's passphrase to a value of their choosing without the administrator's consent, effectively taking control of the Dimension management account. Organizations running WatchGuard Dimension and administering it through the Web UI are affected. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.2%.

What to do: Watch for the WatchGuard advisory and apply the vendor's fixed Dimension release as soon as it is identified, since fixed versions are not stated in the available data. In the meantime, restrict access to the Dimension Web UI to trusted management networks or VPN, avoid clicking unsolicited links while logged in as a global administrator, and review logs for unexpected global-admin passphrase changes.