Simone Paganessi

My 29th CVE has been published following a vulnerability I identified and reported through @Hacker0x01 . CVE-2026-86135: CSRF in Database Snapshot Creation Allows Denial of Service The issue affects the database snapshot creation functionality in WatchGuard Dimension and has been assigned a High severity rating (CVSS v4.0: 7.0). The vulnerability allows a remote attacker to abuse the database snapshot functionality through Cross-Site Request Forgery (CSRF). By tricking an authenticated administrator into visiting a specially crafted page, an attacker can trigger database snapshot creation without the administrator's consent. The security impact becomes particularly relevant when the operation is repeatedly triggered: snapshot files can accumulate on the system, progressively consuming the available disk space and potentially resulting in degraded performance, system instability, and ultimately a Denial of Service condition. Technical classification • CWE: Cross-Site Request Forgery (CSRF) • Impact: Denial of Service / resource exhaustion • Severity: High • CVSS v4.0: 7.0 • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N Advisory: https://t.co/zrKUc86kY3 WatchGuard Technologies #CyberSecurity #VulnerabilityResearch #BugBounty #WatchGuard #HackerOne #SecurityResearch

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A blind server-side request forgery (SSRF) occurs in the Database Server Test configuration. This allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. SSRF is a flaw where an attacker can induce the server to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** WatchGuard Dimension implements a client-side lock/unlock UI control to manage configuration changes. However, the server-side configuration endpoint fails to enforce this workflow state. This allows an authenticated administrator with read-write permissions to submit changes directly to the endpoint, bypassing the UI unlock requirement and potentially overwriting configuration changes made by another concurrent administrator session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the FTP Server Test configuration. This allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A stored cross-site scripting (XSS) issue exists in the task scheduling feature. This allows a low-privileged authenticated administrator to inject arbitrary HTML or JavaScript into specific fields, which subsequently executes within the browser session of any other user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** The web login endpoint does not enforce effective rate-limiting or account lockout by default. This allows a remote attacker to perform automated password guessing against user accounts. While an account lockout setting exists to block brute-force attempts after a defined number of failed attempts, it is not enabled by default. **Recommendations** Enable the account lockout setting to block automated password guessing attempts.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the Remote Backup Connection Test configuration. This allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** An issue in the Backup Historical Data feature allows an authenticated administrator to execute arbitrary JavaScript in the browser of another user. This is a Cross-Site Scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the execution of malicious scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** WatchGuard Dimension records unredacted session identifiers for logged-in users within its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log to extract a Super Administrator's session token during an active session, which allows for account takeover. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the Email Server Test configuration. This allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.4 through 12.12 WatchGuard Fireware OS versions 12.5 through 12.5.18 WatchGuard Fireware OS versions 2025.1 through 2026.2 **Description** Stored Cross-site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or encoding, exists within the Tigerpaw Technology Integration module. This issue provides an additional unmitigated attack path for a related security flaw. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.4 through 12.12 WatchGuard Fireware OS versions 12.5 through 12.5.18 WatchGuard Fireware OS versions 2025.1 through 2026.2 **Description** Stored Cross-site Scripting (XSS) exists in the ConnectWise Technology Integration module. This occurs due to improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are stored on the server and later executed in the browser of other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.0 through 12.12 WatchGuard Fireware OS versions 12.5 through 12.5.18 WatchGuard Fireware OS versions 2025.1 through 2026.2 **Description** The SIP Proxy module contains a flaw involving improper neutralization of input during web page generation, which enables Stored Cross-site Scripting (XSS). XSS is a type of attack where malicious scripts are injected into trusted websites. This issue serves as an additional unmitigated attack path for another known flaw. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 11.8 through 11.12.4+541730 WatchGuard Fireware OS versions 12.0 through 12.11.8 WatchGuard Fireware OS versions 2025.1 through 2026.1.2 **Description** A Cross-Site Request Forgery (CSRF) issue in the Fireware OS WebUI allows a remote attacker to cause a denial-of-service (DoS) condition. This occurs when an authenticated administrator is tricked into visiting a malicious web page, which then triggers the condition in the WebUI. CSRF is a technique where an attacker forces a user's browser to perform an unwanted action on a different website where the user is currently authenticated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.4 through 12.11.4 WatchGuard Fireware OS versions 12.5 through 12.5.13 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 **Description** A flaw exists in the Autotask Technology Integration module of WatchGuard Fireware OS that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. **Recommendations** Update WatchGuard Fireware OS to a version later than 12.11.4. Update WatchGuard Fireware OS to a version later than 12.5.13. Update WatchGuard Fireware OS to a version later than 2025.1.2.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.4 through 12.11.4 WatchGuard Fireware OS versions 12.5 through 12.5.13 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 **Description** A flaw exists in the Tigerpaw Technology Integration module of WatchGuard Fireware OS that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update WatchGuard Fireware OS to a version later than 12.11.4. Update WatchGuard Fireware OS to a version later than 12.5.13. Update WatchGuard Fireware OS to a version later than 2025.1.2.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 12.4 through 12.11.4 WatchGuard Fireware OS versions 12.5 through 12.5.13 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 **Description** A flaw exists in the ConnectWise Technology Integration module of WatchGuard Fireware OS that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Stored XSS occurs when a malicious script is stored on the target server and then executed by other users when they access the affected web page. **Recommendations** Update WatchGuard Fireware OS to a version later than 12.11.4. Update WatchGuard Fireware OS to a version later than 12.5.13. Update WatchGuard Fireware OS to a version later than 2025.1.2.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Fireware OS versions 11.7.2 through 11.12.4+541730 WatchGuard Fireware OS versions 12.0 through 12.11.4 WatchGuard Fireware OS versions 12.5 through 12.5.13 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 **Description** A flaw exists in the Gateway Wireless Controller module of WatchGuard Fireware OS that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update WatchGuard Fireware OS to a version later than 11.12.4+541730. Update WatchGuard Fireware OS to a version later than 12.11.4. Update WatchGuard Fireware OS to a version later than 12.5.13. Update WatchGuard Fireware OS to a version later than 2025.1.2.