CVE-2026-78610CWE-352csrf

CVE-2026-78610

published August 28, 2026

CVSS
8.4
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-28T06:16Z
References (1)
https://psirt.watchguard.com/CVE-2026-78610 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 27 AUG 23:26Z
    Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
    cvelistv5