Cisco and WatchGuard Patch Flaws as SonicWall GMS Issues Remain Unfixed
Cisco and WatchGuard have released fixes for security vulnerabilities in several products, including flaws involving authentication and remote code execution. SonicWall, meanwhile, says two vulnerabilities in its end-of-life Global Management System (GMS) platform will not be patched. The disclosures put different remediation decisions in focus for organizations managing network and security infrastructure: apply available updates, assess exposure where fixes are pending, and plan around unsupported products.
WatchGuard published five security advisories. Four cover critical-severity vulnerabilities, including CVE-2026-98432, a use-after-free flaw in the Linux kernel’s IPv4 networking code with a CVSS score of 9.8. The vulnerable kernel versions are present in Fireware OS and WatchGuard AP, but WatchGuard says those products are not affected by the remote code execution exploit chain that the flaw can enable.
WatchGuard also said its Dimension product runs a vulnerable version of Ubuntu and that patches for Dimension were not yet available. This leaves administrators of that product with a different status from users of Fireware OS and WatchGuard AP: the company has identified the vulnerable component, but a fix was still pending when it issued the advisory.
WatchGuard AuthPoint fixes
Three critical authentication vulnerabilities in AuthPoint Authentication Gateway have been fixed. They are tracked as CVE-2026-121639, CVE-2026-121638 and CVE-2026-121640. WatchGuard also released a fix for CVE-2026-121637, a high-severity integrity validation issue in the same product.
For organizations using the gateway, the advisories make it important to verify which deployments are affected and apply the relevant vendor fixes. Where an update cannot be deployed immediately, security teams should track the remaining exposure and prioritize the system in their remediation process. WatchGuard said it was not aware of any of the vulnerabilities in its advisories being exploited in the wild.
Cisco updates UCS Central and Brotli advisory
Cisco released a fix for CVE-2026-76506, a high-severity vulnerability in UCS Central Software. An authenticated attacker could exploit the issue to execute arbitrary code remotely or disclose information, according to the description in the advisory. Cisco, like WatchGuard, said it was not aware of exploitation of the vulnerabilities covered by the newly announced fixes.
Cisco also updated its advisory for CVE-2026-111497, a flaw in Google’s Brotli data compression library that has been referred to as Node2Shell, HTTP2Shell and Broccoli2Shell. The issue is an out-of-bounds write and has been exploited, making it distinct from the newly disclosed vulnerabilities for which the vendors reported no known in-the-wild activity.
In the updated advisory, Cisco identified 19 affected products and said it was continuing to investigate dozens of others. The flaw also affects nearly a dozen Splunk products. Organizations should therefore check vendor advisories for the specific products and versions in their environments rather than assuming that a Cisco product inventory alone captures their exposure.
SonicWall will not patch end-of-life GMS
SonicWall disclosed two vulnerabilities in Global Management System, its legacy centralized management platform. GMS reached end of life in October 2025, and the company said the issues will remain unpatched.
CVE-2026-109593 is a critical-severity file-read vulnerability that can be exploited without authentication. CVE-2026-109594 is a medium-severity SQL injection flaw that could allow an attacker to access and modify information in the GMS database. The absence of planned fixes means affected organizations cannot treat routine patching as a resolution. They should establish whether GMS remains deployed, assess its role and exposure, and plan a transition away from the unsupported platform.
The disclosures span products with available updates, a product awaiting patches, and an end-of-life management system with no fixes planned. For enterprise teams, the practical first step is to map affected products and versions, then distinguish confirmed remediation from pending or unavailable fixes. The exploitation status also differs: the reported Cisco Brotli flaw has been exploited, while Cisco and WatchGuard said they knew of no exploitation of the newly covered vulnerabilities.
