CVE-2026-78610

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

  • Published Aug 28, 2026
  • CVSS 8.4 high
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-78610 at the National Vulnerability Database