CVE-2026-86135

My 29th CVE has been published following a vulnerability I identified and reported through @Hacker0x01 .

CVE-2026-86135: CSRF in Database Snapshot Creation Allows Denial of Service

The issue affects the database snapshot creation functionality in WatchGuard Dimension and has been assigned a High severity rating (CVSS v4.0: 7.0).

The vulnerability allows a remote attacker to abuse the database snapshot functionality through Cross-Site Request Forgery (CSRF). By tricking an authenticated administrator into visiting a specially crafted page, an attacker can trigger database snapshot creation without the administrator's consent. The security impact becomes particularly relevant when the operation is repeatedly triggered: snapshot files can accumulate on the system, progressively consuming the available disk space and potentially resulting in degraded performance, system instability, and ultimately a Denial of Service condition.

Technical classification • CWE: Cross-Site Request Forgery (CSRF) • Impact: Denial of Service / resource exhaustion • Severity: High • CVSS v4.0: 7.0 • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Advisory: https://t.co/zrKUc86kY3

WatchGuard Technologies

#CyberSecurity #VulnerabilityResearch #BugBounty #WatchGuard #HackerOne #SecurityResearch