CVE-2026-78614CWE-502CWE-89insecure-deserializationsql-injection

CVE-2026-78614

published August 28, 2026

CVSS

8.6

EPSS

Percentile

53.0

In the wild

Unconfirmed

What it is

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: 8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00708 · 53.0th percentile
Weaknesses: CWE-502 · Deserialization of Untrusted Data; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-28T06:16Z

References (1)

https://psirt.watchguard.com/CVE-2026-78614 · 5d1c2695-1a31-4499-88ae-e847036fd7e3

EPSS history

Timeline

27 AUG 23:26Z
Dimension SQL Injection in Audit Report
cvelistv5