Cisco and WatchGuard Patch Flaws; SonicWall Leaves GMS Bugs Unfixed
Summary
Cisco and WatchGuard issued security updates, while SonicWall said two vulnerabilities in its end-of-life GMS platform will remain unpatched. Cisco also expanded its advisory on the exploited Brotli flaw, affecting 19 Cisco products.
Key points
- WatchGuard published five advisories, including fixes for three critical AuthPoint Authentication Gateway authentication flaws and an integrity-validation bug.
- WatchGuard reported a critical Linux-kernel use-after-free flaw (CVE-2026-98432, CVSS 9.8), but said Fireware OS and WatchGuard AP are not affected by the resulting RCE exploit chain.
- WatchGuard said Dimension runs a vulnerable Ubuntu version, but patches are not yet available.
- Cisco released a fix for CVE-2026-76506 in UCS Central Software, which could enable authenticated remote code execution or information disclosure.
- Cisco's updated advisory says 19 products are affected by the exploited Brotli flaw CVE-2026-111497; dozens more are under investigation, and nearly a dozen Splunk products are also affected.
- SonicWall said it will not patch unauthenticated file-read and SQL-injection flaws in its end-of-life Global Management System, which reached end of life in October 2025.
- Cisco and WatchGuard said they were not aware of the vulnerabilities in their advisories being exploited in the wild.
Article Details
- Event Type
- Cisco and WatchGuard released security patches, while SonicWall reported vulnerabilities in its end-of-life Global Management System (GMS) that will remain unpatched.
- Impact
- The reported flaws include remote code execution, authentication, information disclosure, integrity validation, file read, and SQL injection vulnerabilities. Cisco says CVE-2026-111497, the exploited Brotli out-of-bounds write flaw also known as Node2Shell, HTTP2Shell, and Broccoli2Shell, affects 19 Cisco products; dozens more are under investigation, and nearly a dozen Splunk products are also affected. Cisco and WatchGuard said they were unaware of exploitation of the other vulnerabilities discussed. WatchGuard said patches were not yet available for the vulnerable Ubuntu version in Dimension.
CVE
CVE-2026-109593SonicWall · Global Management System (GMS)The first, CVE-2026-109593, is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to accessCVE-2026-109594SonicWall · Global Management System (GMS)is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to access and modify information inCVE-2026-111497Vendor / Product unavailableOn Wednesday, Cisco also updated its advisory on CVE-2026-111497, dubbed Node2Shell, HTTP2Shell, and Broccoli2Shell, the exploited out-of-bounds write flaw in Google’s Brotli data compression library that organizationsCVE-2026-121637Vendor / Product unavailableCVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway.CVE-2026-121638WatchGuard · AuthPoint Authentication GatewayThe company rolled out fixes for three critical authentication issues (CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint AuthenticationCVE-2026-121639WatchGuard · AuthPoint Authentication GatewayThe company rolled out fixes for three critical authentication issues (CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint AuthenticationCVE-2026-121640Vendor / Product unavailablerolled out fixes for three critical authentication issues (CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway.CVE-2026-76506Vendor / Product unavailableCisco released fixes for CVE-2026-76506, a high-severity vulnerability in UCS Central Software that could allow authenticated attackers to execute arbitrary code remotely or leak information.CVE-2026-98432Vendor / Product unavailableThe most severe is CVE-2026-98432 (CVSS score of 9.8), a use-after-free issue in the IPv4 networking code of the Linux kernel.
Vendors
CiscoCisco and WatchGuard this week announced patches for a handful of vulnerabilities in their products, including remote code execution (RCE) and authentication flaws.SonicWallThis week, SonicWall warned that its legacy centralized management platform Global Management System (GMS), which reached End-of-Life (EOL) in October 2025, is affected by two vulnerabilities that will remain unpatched.SplunkThe security defect also impacts nearly a dozen Splunk products.WatchGuardCisco and WatchGuard this week announced patches for a handful of vulnerabilities in their products, including remote code execution (RCE) and authentication flaws.
Products
AuthPoint Authentication Gatewayand CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway.DimensionDimension runs a vulnerable Ubuntu version, but patches are not available yet, WatchGuard says.Fireware OSFireware OS and WatchGuard AP contain the vulnerable Linux kernel versions, but are not affected by the RCE exploit chain it opens the door to.Global Management System (GMS)This week, SonicWall warned that its legacy centralized management platform Global Management System (GMS), which reached End-of-Life (EOL) in October 2025, is affected by two vulnerabilities that will remain unpatched.UCS Central SoftwareCisco released fixes for CVE-2026-76506, a high-severity vulnerability in UCS Central Software that could allow authenticated attackers to execute arbitrary code remotely or leak information.WatchGuard APFireware OS and WatchGuard AP contain the vulnerable Linux kernel versions, but are not affected by the RCE exploit chain it opens the door to.