Cisco and WatchGuard this week announced patches for a handful of vulnerabilities in their products, including remote code execution (RCE) and authentication flaws.
WatchGuard published five advisories, including four describing critical-severity bugs. The most severe is CVE-2026-98432 (CVSS score of 9.8), a use-after-free issue in the IPv4 networking code of the Linux kernel.
Fireware OS and WatchGuard AP contain the vulnerable Linux kernel versions, but are not affected by the RCE exploit chain it opens the door to. Dimension runs a vulnerable Ubuntu version, but patches are not available yet, WatchGuard says.
The company rolled out fixes for three critical authentication issues (CVE-2026-121639, CVE-2026-121638, and CVE-2026-121640) and a high-severity integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway.
Cisco released fixes for CVE-2026-76506, a high-severity vulnerability in UCS Central Software that could allow authenticated attackers to execute arbitrary code remotely or leak information.
Both WatchGuard and Cisco say they are not aware of any of these vulnerabilities being exploited in the wild.
On Wednesday, Cisco also updated its advisory on CVE-2026-111497, dubbed Node2Shell, HTTP2Shell, and Broccoli2Shell, the exploited out-of-bounds write flaw in Google’s Brotli data compression library that organizations have been scrambling to patch.
Per the updated advisory, 19 Cisco products are affected by Node2Shell, and the company is still investigating dozens more. The security defect also impacts nearly a dozen Splunk products.
This week, SonicWall warned that its legacy centralized management platform Global Management System (GMS), which reached End-of-Life (EOL) in October 2025, is affected by two vulnerabilities that will remain unpatched.
The first, CVE-2026-109593, is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to access and modify information in the GMS database.
Related: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Related: Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Related: Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
