CVE-2026-78612CWE-502CWE-89insecure-deserializationsql-injection

CVE-2026-78612

published August 28, 2026

CVSS

8.6

EPSS

Percentile

52.9

In the wild

Unconfirmed

What it is

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: 8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00708 · 52.9th percentile
Weaknesses: CWE-502 · Deserialization of Untrusted Data; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-28T06:16Z

References (1)

https://psirt.watchguard.com/CVE-2026-78612 · 5d1c2695-1a31-4499-88ae-e847036fd7e3

EPSS history

Timeline

27 AUG 23:26Z
Dimension SQL Injection in Scheduled Report
cvelistv5