PT-2026-82856

CVE-2026-78617

Published

2026-08-27

Updated

2026-08-28

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WatchGuard Dimension (affected versions not specified)

Description The web login endpoint does not enforce effective rate-limiting or account lockout by default. This allows a remote attacker to perform automated password guessing against user accounts. While an account lockout setting exists to block brute-force attempts after a defined number of failed attempts, it is not enabled by default.

Recommendations Enable the account lockout setting to block automated password guessing attempts.

Exploitability

Fix

Impacts

Researchers

Simone Paganessi

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts

CWE-203: Observable Discrepancy

Related identifiers