CVE-2026-78610: Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-28
Weakness: CWE-352

Description

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

Affected products

WatchGuard Dimension: from 2.0 before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: WatchGuard Dimension 2.3.1. Check the vendor advisory for mitigations.

References

https://psirt.watchguard.com/CVE-2026-78610

Get alerted when CVE-2026-78610 or the next vulnerability affects your stack