High severity · published Aug 27, 2026
CVE-2026-78610
Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Dimension · WatchGuard
2.0 before 2.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78610
psirt.watchguard.com
https://psirt.watchguard.com/CVE-2026-78610
More from Dimension
9.3
CVE-2026-78174
WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
8.7
CVE-2026-13108
Dimension Denial-of-Service
8.6
CVE-2026-78612
Dimension SQL Injection in Scheduled Report
8.6
CVE-2026-78613
Dimension SQL Injection in Log Viewer
8.6
CVE-2026-78614
Dimension SQL Injection in Audit Report