Cisco, WatchGuard Patch Critical Flaws While SonicWall Leaves EOL GMS Vulnerabilities Unfixed
Cisco and WatchGuard released a batch of patches this week addressing remote code execution, authentication bypass, and integrity-validation flaws across multiple products, while SonicWall confirmed it will not patch two vulnerabilities in its end-of-life Global Management System (GMS) platform. WatchGuard published five advisories, the most severe being CVE-2026-98432 (CVSS 9.8), a use-after-free in the Linux kernel's IPv4 code affecting Fireware OS, WatchGuard AP, and Dimension, alongside four previously disclosed critical/high AuthPoint Authentication Gateway flaws. Cisco fixed a high-severity authenticated RCE/information-disclosure bug in UCS Central Software (CVE-2026-76506) and updated its advisory on the actively exploited Brotli library flaw known as Node2Shell/HTTP2Shell/Broccoli2Shell (CVE-2026-111497), now confirmed to affect 19 Cisco products and nearly a dozen Splunk products, with investigation ongoing. SonicWall disclosed that its legacy GMS platform, which reached end-of-life in October 2025, contains an unauthenticated critical file-read vulnerability (CVE-2026-109593) and a medium-severity SQL injection flaw (CVE-2026-109594) that will remain unpatched. Neither Cisco nor WatchGuard reported active exploitation of the newly patched issues, but Node2Shell is already under active exploitation per prior reporting.
Entenda a falha
A vulnerabilidade
The most severe flaw is CVE-2026-98432 (CVSS 9.8), a use-after-free in the IPv4 networking code of the Linux kernel. WatchGuard Fireware OS and WatchGuard AP ship vulnerable kernel versions but are not affected by the RCE exploit chain it enables. Dimension runs a vulnerable Ubuntu version and has no patch yet. WatchGuard also fixed three critical authentication flaws (CVE-2026-121639, CVE-2026-121638, CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway. SonicWall will not fix CVE-2026-109593 (critical, unauthenticated file read) or CVE-2026-109594 (medium SQL injection) in the end-of-life GMS. Cisco fixed CVE-2026-76506 in UCS Central Software, where an authenticated attacker could run code remotely or leak information. CVE-2026-111497 (Node2Shell), an out-of-bounds write in Google's Brotli library, is exploited in the wild and affects 19 Cisco products and nearly a dozen Splunk products. The articles give no affected version numbers.
Como funciona
For CVE-2026-98432, the articles only say the bug is a use-after-free in the kernel's IPv4 networking code, which opens the door to an RCE exploit chain. In general terms, the kernel frees a memory object while a reference to it is still in use, and later processing of network traffic touches that stale memory. For Node2Shell, Brotli-compressed data is processed by the library, which writes outside the bounds of its buffer. The articles give no further step-by-step detail on either flaw or on the other CVEs.
Por que é vulnerável
CVE-2026-98432 is a memory-safety error: memory is used after it was freed in the Linux kernel IPv4 code. CVE-2026-111497 is an out-of-bounds write in Brotli, also a memory-safety error. For the SonicWall GMS flaws, the underlying cause is that the product is end-of-life since October 2025, so SonicWall will issue no fix. The articles do not describe the root cause of the other CVEs, why they went unnoticed, or what the fixes change.
Como foi descoberta
The articles do not say who found these flaws or how. WatchGuard published five advisories this week, and SecurityWeek describes the four AuthPoint flaws in the story as previously disclosed. Cisco released fixes for CVE-2026-76506 and updated its advisory for CVE-2026-111497 on Wednesday, still investigating dozens more products. SonicWall warned this week that its end-of-life GMS has two flaws that will stay unpatched. WatchGuard and Cisco say they know of no exploitation of the newly patched issues, while Node2Shell is already exploited in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 10:16.
Detalhes técnicos
- CVE-2026-98432 (CVSS 9.8) — Use-after-free in Linux kernel IPv4 networking code; Dimension is vulnerable but no patch is yet available.
- CVE-2026-76506 — High-severity flaw in Cisco UCS Central Software allowing authenticated attackers to execute arbitrary code or leak information.
- CVE-2026-111497 (Node2Shell/HTTP2Shell/Broccoli2Shell) — Out-of-bounds write in Google's Brotli compression library, confirmed in 19 Cisco products and nearly a dozen Splunk products, with more under investigation.
- CVE-2026-109593 — Critical, unauthenticated file-read vulnerability in SonicWall GMS (EOL, unpatched).
- CVE-2026-109594 — Medium-severity SQL injection in SonicWall GMS allowing database access/modification (EOL, unpatched).
Remediação
Apply WatchGuard and Cisco patches immediately where available; WatchGuard Dimension users should restrict network access pending a fix. Organizations still running SonicWall GMS should migrate off the end-of-life platform since no patches will be issued for the file-read and SQL injection flaws; isolate or decommission exposed GMS instances.
Linha do tempo
-
Cisco, WatchGuard Patch Critical Flaws While SonicWall Leaves EOL GMS Vulnerabilities Unfixed
ler a análise desta fonte ocultar
Cisco and WatchGuard released a batch of patches this week addressing remote code execution, authentication bypass, and integrity-validation flaws across multiple products, while SonicWall confirmed it will not patch two vulnerabilities in its end-of-life Global Management System (GMS) platform. WatchGuard published five advisories, the most severe being CVE-2026-98432 (CVSS 9.8), a use-after-free in the Linux kernel's IPv4 code affecting Fireware OS, WatchGuard AP, and Dimension, alongside four previously disclosed critical/high AuthPoint Authentication Gateway flaws. Cisco fixed a high-severity authenticated RCE/information-disclosure bug in UCS Central Software (CVE-2026-76506) and updated its advisory on the actively exploited Brotli library flaw known as Node2Shell/HTTP2Shell/Broccoli2Shell (CVE-2026-111497), now confirmed to affect 19 Cisco products and nearly a dozen Splunk products, with investigation ongoing. SonicWall disclosed that its legacy GMS platform, which reached end-of-life in October 2025, contains an unauthenticated critical file-read vulnerability (CVE-2026-109593) and a medium-severity SQL injection flaw (CVE-2026-109594) that will remain unpatched. Neither Cisco nor WatchGuard reported active exploitation of the newly patched issues, but Node2Shell is already under active exploitation per prior reporting.
Technical Details
- CVE-2026-98432 (CVSS 9.8) — Use-after-free in Linux kernel IPv4 networking code; Dimension is vulnerable but no patch is yet available.
- CVE-2026-76506 — High-severity flaw in Cisco UCS Central Software allowing authenticated attackers to execute arbitrary code or leak information.
- CVE-2026-111497 (Node2Shell/HTTP2Shell/Broccoli2Shell) — Out-of-bounds write in Google's Brotli compression library, confirmed in 19 Cisco products and nearly a dozen Splunk products, with more under investigation.
- CVE-2026-109593 — Critical, unauthenticated file-read vulnerability in SonicWall GMS (EOL, unpatched).
- CVE-2026-109594 — Medium-severity SQL injection in SonicWall GMS allowing database access/modification (EOL, unpatched).
Remediation
Apply WatchGuard and Cisco patches immediately where available; WatchGuard Dimension users should restrict network access pending a fix. Organizations still running SonicWall GMS should migrate off the end-of-life platform since no patches will be issued for the file-read and SQL injection flaws; isolate or decommission exposed GMS instances.