CVEvulnerability

CVE-2026-78612

8.6 HIGH Published 2026-08-28 Modified 2026-08-28 Official page ↗
Status
Deferred
Published
2026-08-28
Last modified
2026-08-28
Assigner
5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS 4.0 (5d1c2695-1a31-4499-88ae-e847036fd7e3)
8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-502, CWE-89

Description

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

Related

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References