CVE-2026-78495: WatchGuard Dimension SSRF Vulnerability

CVE-2026-78495 Overview

CVE-2026-78495 is a Server-Side Request Forgery (SSRF) vulnerability in the WatchGuard Dimension Remote Backup Connection Test configuration. An authenticated attacker with privileged access can abuse the connection test feature to issue arbitrary outbound requests from the Dimension appliance. This allows enumeration of exposed network services on systems adjacent to the appliance. The flaw is tracked under CWE-918: Server-Side Request Forgery and carries a medium severity rating.

Critical Impact
A privileged authenticated attacker can leverage the Dimension appliance as a proxy to scan and enumerate internal network services that are otherwise unreachable from the external network.

Affected Products

WatchGuard Dimension
WatchGuard Dimension Remote Backup Connection Test configuration
See the WatchGuard PSIRT advisory for specific affected versions

Discovery Timeline

2026-08-28 - CVE-2026-78495 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-78495

Vulnerability Analysis

WatchGuard Dimension provides a Remote Backup feature that stores appliance backups on an external server. The configuration workflow includes a Connection Test that validates the connection parameters supplied by the administrator. The test function issues an outbound request to the destination defined by the user without properly restricting the target host or port.

An authenticated user with privileges to modify the Remote Backup configuration can substitute the intended backup server address with an arbitrary internal host and port. The appliance then performs the connection attempt on the attacker's behalf. Response behavior, timing, or error messages can reveal whether the specified service is reachable and listening.

The vulnerability requires authentication and elevated privileges, which limits exposure to insiders or attackers who have already compromised a privileged account. However, the Dimension appliance typically resides in a trusted network segment with connectivity to internal management systems. This positioning amplifies the impact of the SSRF primitive for reconnaissance.

Root Cause

The root cause is missing validation of user-supplied destination parameters in the Remote Backup Connection Test handler. The feature accepts arbitrary hostnames and ports without an allowlist, protocol enforcement, or network zone restrictions. This maps to CWE-918, where server-side code accepts an attacker-influenced URL and performs a request without sufficient controls.

Attack Vector

Exploitation requires network access to the Dimension management interface and valid credentials for a privileged account. The attacker navigates to the Remote Backup configuration, supplies an internal IP address and target port in place of a legitimate backup server, and triggers the Connection Test. Observed response differences between open, closed, and filtered ports enable service enumeration across adjacent subnets. Refer to the WatchGuard advisory for authoritative technical detail.

Detection Methods for CVE-2026-78495

Indicators of Compromise

Outbound TCP connections from the WatchGuard Dimension appliance to internal hosts on non-backup ports
Repeated Remote Backup Connection Test invocations in Dimension audit logs targeting varying destinations
Configuration changes to the Remote Backup destination host or port made outside of normal change windows
Authenticated administrative sessions to Dimension originating from unexpected source addresses

Detection Strategies

Baseline the legitimate backup destinations and alert on connection attempts from Dimension to any other internal host or port
Correlate Dimension administrative activity with subsequent internal probe traffic sourced from the appliance IP
Review audit logs for a high frequency of Connection Test operations from a single user account

Monitoring Recommendations

Forward Dimension audit and web UI logs to a centralized logging platform for retention and correlation
Monitor privileged account usage on Dimension, including logins outside business hours and from new geographies
Instrument network flow collection at the segment hosting Dimension to detect lateral scanning patterns

How to Mitigate CVE-2026-78495

Immediate Actions Required

Apply the fixed version of WatchGuard Dimension identified in the WatchGuard PSIRT advisory
Restrict access to the Dimension management interface to trusted administrative networks only
Audit and reduce the number of accounts with privileges to modify Remote Backup configuration
Rotate credentials for any privileged Dimension accounts suspected of misuse

Patch Information

WatchGuard has published guidance and fixed builds through the WatchGuard PSIRT advisory for CVE-2026-78495. Administrators should consult the advisory for the specific fixed release, upgrade procedure, and any prerequisite steps before deploying the update.

Workarounds

Segment the Dimension appliance so it cannot reach internal management services beyond the required backup destination
Apply egress firewall rules that allow outbound connections from Dimension only to approved backup server addresses and ports
Enforce multi-factor authentication on all Dimension administrative accounts to reduce the risk of credential-based abuse
Enable and review audit logging on the Dimension appliance to capture Remote Backup configuration changes

bash

# Example egress restriction: allow Dimension to reach only the approved backup host
# Replace DIMENSION_IP and BACKUP_HOST with the actual addresses in your environment
iptables -A FORWARD -s DIMENSION_IP -d BACKUP_HOST -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -s DIMENSION_IP -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s DIMENSION_IP -d 172.16.0.0/12 -j DROP
iptables -A FORWARD -s DIMENSION_IP -d 192.168.0.0/16 -j DROP