CVE-2026-78614

WatchGuard Dimension, the vendor's on-premises network visibility and log-management appliance, contains an authenticated SQL injection flaw (CWE-89) in its audit report feature. An authenticated user holding report administration permissions can send specially crafted requests to that feature, and the injected input leads to arbitrary command execution as the Dimension WebUI process user; the associated CWE-502 (deserialization of untrusted data) mapping suggests the injection may flow into a deserialization step to achieve command execution. Because CVSS 4.0 rates high impact to confidentiality, integrity, and availability of the vulnerable component, attackers gaining command execution can compromise the appliance and any data it manages, though privileges are limited to the WebUI service account. Only organizations running WatchGuard Dimension, typically deployed alongside WatchGuard Firebox firewalls for centralized logging and reporting, are affected. There are no known reports of in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a modest 0.7% probability of exploitation within 30 days.

What to do: Upgrade WatchGuard Dimension to the latest patched release published by the vendor (the specific fixed version is not stated in the available data — check the WatchGuard advisory). Until patched, restrict access to the Dimension WebUI to trusted management networks, minimize the number of accounts holding report administration rights, and review Dimension audit/reporting logs for anomalous or crafted report requests.