SecurityWeek reports Cisco, WatchGuard patches and unfixed SonicWall GMS flaws

What happened

According to SecurityWeek, Cisco and WatchGuard announced patches this week for several vulnerabilities, and SonicWall says two flaws in its legacy GMS platform will remain unpatched.

• SonicWall GMS: SonicWall says GMS reached end of life in October 2025. SecurityWeek reports that CVE-2026-109593 is a critical-severity file read bug that can be exploited without authentication. It also reports that CVE-2026-109594 is a medium-severity SQL injection that could let attackers access and modify data in the GMS database (SecurityWeek).
• WatchGuard: WatchGuard published five advisories, four of them critical, according to SecurityWeek. The most severe is CVE-2026-98432 (CVSS 9.8), a use-after-free in the Linux kernel IPv4 networking code. WatchGuard says Fireware OS and WatchGuard AP contain the vulnerable kernel versions but are not affected by the RCE exploit chain. It also says Dimension runs a vulnerable Ubuntu version and that patches are not yet available for it (SecurityWeek).
• WatchGuard AuthPoint Authentication Gateway: WatchGuard fixed three critical authentication issues, CVE-2026-121639, CVE-2026-121638 and CVE-2026-121640, plus a high-severity integrity validation bug, CVE-2026-121637 (SecurityWeek).
• Cisco UCS Central Software: Cisco released fixes for CVE-2026-76506, a high-severity flaw that could let authenticated attackers execute arbitrary code remotely or leak information (SecurityWeek).
• Node2Shell (Brotli): SecurityWeek reports that Cisco updated its advisory on CVE-2026-111497, an out-of-bounds write in Google’s Brotli library that SecurityWeek describes as exploited. Per that update, 19 Cisco products are affected and Cisco is still investigating dozens more (SecurityWeek).
• Splunk: Splunk’s own advisory rates CVE-2026-111497 and three related Node.js flaws as High. The related flaws are CVE-2026-105482 (DNS resolution truncation), CVE-2026-105483 and CVE-2026-106069 (TLS hostname validation bypasses) (Splunk).

Cisco and WatchGuard say they are not aware of exploitation of their own vulnerabilities (SecurityWeek).

The following details are not confirmed by the sources:

• Fixed version numbers for Cisco and WatchGuard.
• CVSS scores beyond CVE-2026-98432.
• Whether the SonicWall GMS flaws are being exploited.

Am I affected?

• SonicWall GMS: You are affected if you run GMS. SonicWall will not release a fix.
• WatchGuard: You are affected if you use AuthPoint Authentication Gateway or Dimension. WatchGuard says Fireware OS and WatchGuard AP are not affected by the RCE chain.
• Cisco UCS Central Software: You are affected if you run it. Affected versions are not confirmed in the sources.
• Splunk: Splunk lists these products as affected (Splunk):
  • Splunk Enterprise 10.0
  • Splunk Visual Exporter (included in all Splunk Enterprise versions)
  • Splunk SOAR Automation Broker
  • Splunk UBA
  • Splunk Attack Analyzer
  • Python for Scientific Computing
  • AppDynamics SaaS and On-Premises
  • Smartlook
  • Splunk Observability Cloud
  • Splunk Observability OpenTelemetry Collector

Splunk says Enterprise 9.4 and 10.2 and higher are not affected. It also says Splunk Cloud Platform, Universal Forwarder, Enterprise Security and several other products are unaffected. Galileo is still under investigation.

• Other Cisco products: For Cisco products exposed to CVE-2026-111497, check Cisco’s updated advisory. SecurityWeek does not list the 19 products.

What to do now

1. If you run SonicWall GMS, plan its replacement, since SonicWall says both flaws will stay unpatched.
2. Apply WatchGuard’s fixes for AuthPoint Authentication Gateway. For Dimension, watch for WatchGuard’s patch, as WatchGuard says none is available yet.
3. Apply Cisco’s fix for UCS Central Software (CVE-2026-76506).
4. On Splunk Enterprise 10.0, upgrade to 10.2 or higher. Disable or remove the Splunk Visual Exporter app, because Splunk says the upgrade does not fix that app (Splunk).
5. Track the Cisco and Splunk advisories for CVE-2026-111497, as both vendors say their investigations are ongoing.

Sources

• SecurityWeek: Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
• Splunk: SVD-2026-1015 Vulnerabilities in Node.js on Splunk Products