CVE-2026-78617CWE-203CWE-307

CVE-2026-78617

published August 28, 2026

CVSS
6.3
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00323 · 24.8th percentile
Weaknesses
CWE-203 · Observable Discrepancy; CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-08-28T06:16Z
References (1)
https://psirt.watchguard.com/CVE-2026-78617 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 27 AUG 23:26Z
    WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
    cvelistv5