CVE-2026-86135

Deferred Deferred - Pending Action

Cross-Site Request Forgery in WatchGuard Dimension

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: WatchGuard Technologies, Inc.

Description

A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86135

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	dimension	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature. It allows a remote attacker to trigger unauthorized snapshot creation by deceiving an authenticated administrator into visiting a malicious webpage.

Detection Guidance

Detecting this CSRF vulnerability requires monitoring for unauthorized snapshot creation requests. Check WatchGuard Dimension logs for unexpected database snapshot activities initiated by administrators without their interaction. Look for HTTP POST requests to snapshot endpoints with forged referer headers or unusual session tokens.

Impact Analysis

An attacker could exploit this to create unauthorized database snapshots, potentially leading to data theft, manipulation, or disruption of services if the snapshots contain sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating compliance requirements for data protection and privacy such as GDPR or HIPAA, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Apply vendor patches or updates for WatchGuard Dimension immediately. Disable or restrict access to the snapshot creation feature if not essential. Implement CSRF tokens in all administrative interfaces and enforce strict referer header validation. Educate administrators to avoid visiting untrusted web pages while logged into the system.

Hi! I’m here to help you understand CVE-2026-86135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70