PT-2026-82854

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

PT-2026-82823

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A stack-based buffer overflow occurs in the epm Endpoint Protection Manager service, which is utilized by the deprecated Mobile Security feature. This flaw allows an...

PT-2026-82851

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82842

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

PT-2026-82830

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A stack-based buffer overflow in the iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. A stack-based...

PT-2026-82827

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A type confusion issue in the iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. Type confusion occur...

PT-2026-82856

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

PT-2026-82824

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service...

PT-2026-82853

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82855

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

PT-2026-82843

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

PT-2026-82846

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

PT-2026-82839

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

PT-2026-82849

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

PT-2026-82828

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

PT-2026-82825

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A heap overflow in the iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. A heap overflow occurs when...

PT-2026-82840

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

PT-2026-82852

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82838

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A buffer overflow in the Management Web UI allows an authenticated administrator with network access to trigger a denial of service DoS condition or potentially execute arbitra...

PT-2026-82850

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...