CVE-2026-78174: WatchGuard Dimension

Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days.

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.

Affected products

• WatchGuard Dimension: from 2.0, before 2.3.1 (fixed in 2.3.1)

Published 2026-08-28. Last modified 2026-08-28.