Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws

Cisco and WatchGuard this week released patches for remote code execution and authentication flaws. SonicWall said two Global Management System bugs will remain unpatched. Cisco fixed high-severity CVE-2026-76506 in UCS Central Software, which could allow an authenticated attacker to execute arbitrary code remotely or leak information. WatchGuard published five advisories, four of them critical-severity bugs, led by CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 networking code, CVSS 9.8. Ionut Arghire, SecurityWeek's international correspondent, described them in SecurityWeek's report.

This piece is for administrators of Cisco UCS Central Software, WatchGuard Fireware OS, WatchGuard AP, Dimension, and AuthPoint Authentication Gateway, plus anyone still running SonicWall's legacy centralized management platform, which reached end of life in October 2025. It covers the Cisco flaws, who is exposed, what to apply, how the bugs work, and what remains open. Wednesday's Cisco update covers exploited CVE-2026-111497, dubbed Node2Shell, HTTP2Shell, and Broccoli2Shell.

What broke in Cisco

Cisco released fixes for CVE-2026-76506, a high-severity vulnerability in UCS Central Software. An authenticated attacker could use it to execute arbitrary code remotely or leak information. Cisco says it is not aware of exploitation in the wild. On Wednesday, Cisco updated its advisory on CVE-2026-111497, an exploited out-of-bounds write in Google's Brotli data compression library, dubbed Node2Shell, HTTP2Shell, and Broccoli2Shell. Organizations have been scrambling to patch it. Nineteen Cisco products are affected, Cisco is still investigating dozens more, and nearly a dozen Splunk products are impacted.

WatchGuard's most severe bug is CVE-2026-98432, CVSS 9.8, a use-after-free in the IPv4 networking code of the Linux kernel. It opens the door to a remote code execution exploit chain. Fireware OS and WatchGuard AP contain the vulnerable kernel versions and are not affected by that chain. Dimension runs a vulnerable Ubuntu version, and WatchGuard says patches are not available yet. WatchGuard fixed critical authentication issues CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640, plus high-severity integrity validation bug CVE-2026-121637 in AuthPoint Authentication Gateway. SonicWall's unpatched bugs are CVE-2026-109593, a critical unauthenticated file read, and CVE-2026-109594, a medium-severity SQL injection.

Who is exposed by Cisco

Customers of UCS Central Software are exposed to CVE-2026-76506, which could allow an authenticated attacker to execute arbitrary code remotely or leak information. Cisco says it is not aware of exploitation in the wild. CVE-2026-111497, also called HTTP2Shell and Broccoli2Shell, is an exploited out-of-bounds write in Google's Brotli data compression library known as Node2Shell. Nineteen Cisco products are affected, dozens more are still under investigation, and nearly a dozen Splunk products are impacted. Organizations have been scrambling to patch that flaw.

Fireware OS and WatchGuard AP contain the Linux kernel versions behind CVE-2026-98432, CVSS 9.8, and are not affected by the remote code execution exploit chain. Dimension runs a vulnerable Ubuntu version, and WatchGuard says patches are not available yet. AuthPoint Authentication Gateway had three critical authentication issues, CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640, and high-severity integrity validation bug CVE-2026-121637. SonicWall Global Management System reached end of life in October 2025. Unauthenticated file-read bug CVE-2026-109593 and SQL injection CVE-2026-109594 will remain unpatched on that centralized management platform.

What to do now about Cisco

Apply Cisco's fix for CVE-2026-76506 on UCS Central Software. That high-severity bug could allow an authenticated attacker to execute arbitrary code remotely or leak information. Cisco says it is not aware of exploitation in the wild. Nineteen Cisco products are affected by CVE-2026-111497, the exploited out-of-bounds write in Google's Brotli data compression library called Node2Shell, HTTP2Shell, and Broccoli2Shell. Organizations have been scrambling to patch it. Cisco is still investigating dozens more products, and nearly a dozen Splunk products are impacted.

Install the WatchGuard fixes for AuthPoint Authentication Gateway: critical authentication issues CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640, and high-severity integrity validation bug CVE-2026-121637. WatchGuard says it is not aware of exploitation in the wild. Fireware OS and WatchGuard AP contain the vulnerable kernel versions tied to CVE-2026-98432 and are not affected by the remote code execution chain. WatchGuard says patches are not available yet for Dimension's vulnerable Ubuntu version. SonicWall will not fix CVE-2026-109593 or CVE-2026-109594 on Global Management System after its October 2025 end of life.

How the Cisco issue works

In UCS Central Software, CVE-2026-76506 could allow an authenticated attacker to execute arbitrary code remotely or leak information. CVE-2026-111497 is an out-of-bounds write in Google's Brotli data compression library, and that flaw is already exploited. Node2Shell, HTTP2Shell, and Broccoli2Shell are the names attached to it. Cisco's updated advisory puts 19 Cisco products on the affected list and says the company is still investigating dozens more. Nearly a dozen Splunk products are impacted. Organizations have been scrambling to patch the Brotli defect.

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 networking code, scored CVSS 9.8, and it opens the door to a remote code execution exploit chain. Fireware OS and WatchGuard AP contain the vulnerable kernel versions and are not affected by that chain. Dimension runs a vulnerable Ubuntu version, and WatchGuard says patches are not available yet. CVE-2026-109593 is a critical-severity file read exploitable without authentication. CVE-2026-109594 is a medium-severity SQL injection that could allow attackers to access and modify information in the GMS database.

What is still unknown about Cisco

Nineteen Cisco products are affected by CVE-2026-111497, and Cisco is still investigating dozens more products. The defect is an exploited out-of-bounds write in Google's Brotli data compression library, called Node2Shell, HTTP2Shell, and Broccoli2Shell. Nearly a dozen Splunk products are impacted, and organizations have been scrambling to patch. Cisco says it is not aware of exploitation in the wild for high-severity UCS Central Software vulnerability CVE-2026-76506. That vulnerability could allow an authenticated attacker to execute arbitrary code remotely or leak information.

WatchGuard says it is not aware of exploitation in the wild for the flaws in its five advisories, and that patches are not available yet for Dimension, which runs a vulnerable Ubuntu version. Fireware OS and WatchGuard AP contain the Linux kernel versions tied to CVE-2026-98432, the CVSS 9.8 use-after-free in IPv4 networking code, and are not affected by the remote code execution chain. SonicWall warned that its legacy Global Management System, end of life since October 2025, will keep CVE-2026-109593 and CVE-2026-109594 unpatched.