PSIRT WatchGuard CVE-2026-78174

psirt.watchguard.com • August 29, 2026

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.

Impact: By harvesting the Super Administrator's session ID and CSRF token from the diagnostic log, an authenticated low-privileged Dimension Administrator can fully impersonate the Super Administrator, bypassing all access control restrictions. This allows the attacker to access and modify the Access Management section, create, delete, or alter any user or group, change system-wide configuration, lock out legitimate administrators, and gain persistent full administrative control over the Dimension appliance.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Fireware OS Require Immediate Patching Multiple critical vulnerabilities have been identified in WatchGuard Fireware OS and WatchGuard Dimension, with CVSS scores of 9.3. These include CVE-2026-19318, a stack-based buffer overflow in the iked process, allowing remote unauthenticated attackers to execute arbitrary code via crafted network traffic. Other vulnerabilities include CVE-2026-19315 (type confusion) and CVE-2026-19313 (heap overflow), both also enabling remote code execution. Additionally, CVE-2026-78174 allows low-privileged admins to hijack high-privileged accounts. No confirmed exploitation has been reported, but organizations are urged to apply patches immediately. The vulnerabilities affect devices running Fireware OS and Dimension, which are critical for network security. WatchGuard recommends restricting access to affected services until patches are applied. 17 sources 61

Extracted Entities

PSIRT WatchGuard CVE-2026-78174

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (4)

MITRE ATT&CK (2)

Platforms (1)