CVE-2026-78610

HighCVSS 8.4/10Last modified Aug 28, 2026

Description

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-786128.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated use CVE-2026-786138.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with CVE-2026-786148.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user wi CVE-2026-786154.6A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary Ja CVE-2026-786164.8A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated adm CVE-2026-786176.3WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker CVE-2026-786186.9A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single l CVE-2026-786199.8Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recover CVE-2026-78628.6The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing u CVE-2026-786204.9The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents CVE-2026-786226.0The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its content CVE-2026-786239.9The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datasto