Cisco and WatchGuard have shipped fixes for several vulnerabilities, while SonicWall says it will not patch two flaws in its end-of-life Global Management System (GMS).
Cisco
- CVE-2026-76506 (high): affects Cisco UCS Central Software. An authenticated attacker could execute code remotely or leak information. Fixed.
- CVE-2026-111497 (named Node2Shell, HTTP2Shell and Broccoli2Shell): an out-of-bounds write in Google's Brotli compression library, now exploited in the wild. Cisco's updated advisory lists 19 affected products, with dozens more under investigation. Nearly a dozen Splunk products are also affected.
WatchGuard
WatchGuard published five advisories, four of them critical.
- CVE-2026-98432 (CVSS 9.8): a use-after-free in the Linux kernel IPv4 networking code. Fireware OS and WatchGuard access points ship vulnerable kernel versions but are not affected by the RCE chain. Dimension runs a vulnerable Ubuntu version, and no patch is available yet.
- CVE-2026-121639, CVE-2026-121638, CVE-2026-121640: critical authentication flaws in AuthPoint Authentication Gateway. Fixed.
- CVE-2026-121637: a high-severity integrity validation bug in AuthPoint Authentication Gateway. Fixed.
WatchGuard and Cisco say they know of no in-the-wild exploitation of their newly patched flaws.
SonicWall GMS: No Fix
SonicWall GMS reached end of life in October 2025. Two newly reported flaws will not be patched:
| CVE | Severity | Issue |
|---|---|---|
| CVE-2026-109593 | Critical | Unauthenticated file read |
| CVE-2026-109594 | Medium | SQL injection that could expose or modify the GMS database |
Recommended Actions
- Apply the Cisco UCS Central and AuthPoint Authentication Gateway updates.
- Check your Cisco and Splunk products against Cisco's advisory for CVE-2026-111497, since it is exploited in the wild, and patch as fixes become available.
- If you run WatchGuard Dimension, restrict access until a patch is released.
- Retire SonicWall GMS or migrate to a supported management platform. If it must stay, remove it from internet exposure and limit access to a management network.