CVE-2026-78612

WatchGuard Dimension contains an authenticated SQL injection vulnerability (CWE-89; the CWE mapping also includes CWE-502, deserialization of untrusted data) in its scheduled report feature. An attacker who holds an account with report administration permissions can trigger the flaw by sending specially crafted requests to that feature. Successful exploitation yields arbitrary command execution as the user running the Dimension WebUI process, and the flaw carries a CVSS 4.0 score of 8.6 (high). Only organizations running WatchGuard Dimension are affected; the available data does not specify which version ranges are impacted. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.7% probability of exploitation within 30 days, so no active exploitation is confirmed at this time.

What to do: Upgrade WatchGuard Dimension to the fixed release identified in WatchGuard's advisory for CVE-2026-78612 (the available data does not state a specific version number). Until patched, limit Dimension WebUI access to trusted networks, minimize the number of accounts with report administration permissions, and review logs for unusual requests to the scheduled report feature.