Cisco, WatchGuard Release Patches; SonicWall Won't Fix GMS Flaws

Cisco and WatchGuard this week announced patches for a handful of vulnerabilities in their products, including remote code execution (RCE) and authentication flaws.

WatchGuard published five advisories, including four describing critical-severity bugs. The most severe is CVE-2026-98432 (CVSS score of 9.8), a use-after-free issue in the IPv4 networking code of the Linux kernel.

Fireware OS and WatchGuard AP contain the vulnerable Linux kernel versions, but are not affected by the RCE exploit chain it opens the door to. Dimension runs a vulnerable Ubuntu version, but patches are not available yet, WatchGuard says.

The company rolled out fixes for three critical authentication issues (CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway.

Cisco released fixes for CVE-2026-76506, a high-severity vulnerability in UCS Central Software that could allow authenticated attackers to execute arbitrary code remotely or leak information.

Both WatchGuard and Cisco say they are not aware of any of these vulnerabilities being exploited in the wild.

On Wednesday, Cisco also updated its advisory on CVE-2026-111497, dubbed Node2Shell, HTTP2Shell, and Broccoli2Shell, the exploited out-of-bounds write flaw in Google’s Brotli data compression library that organizations have been scrambling to patch .

Per the updated advisory, 19 Cisco products are affected by Node2Shell, and the company is still investigating dozens more. The security defect also impacts nearly a dozen Splunk products.

This week, SonicWall warned that its legacy centralized management platform Global Management System (GMS), which reached End-of-Life (EOL) in October 2025, is affected by two vulnerabilities that will remain unpatched.

The first, CVE-2026-109593, is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to access and modify information in the GMS database.

Related: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

Related: Barracuda ESG Authentication Bypass Flaw Opens Path to Root

Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical

Related: Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

Barracuda ESG Authentication Bypass Flaw Opens Path to Root

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.

Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical

The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.

Artificial Intelligence

Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.

Android’s November 2026 Updates Patch Over 200 Vulnerabilities

The most severe is a critical flaw in Framework leading to remote code execution without user interaction.

Critical Node-RED Flaw Exploited in Attacks

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

Fresh WordPress Vulnerability in Attackers’ Crosshairs

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.