Cisco and WatchGuard Patch Flaws; SonicWall Leaves GMS Bugs Unfixed

Cisco and WatchGuard rolled out patches for several high‑severity vulnerabilities this week, while SonicWall announced that it will not issue fixes for two flaws in its legacy Global Management System. The announcements came from SecurityWeek on November 5, 2026. Both vendors say they are not aware of active exploitation, but the risk remains for unpatched environments.

Key vulnerabilities addressed by Cisco and WatchGuard

According to SecurityWeek, WatchGuard published five advisories, four of which describe critical‑severity bugs. The most serious is CVE‑2026‑98432, a use‑after‑free flaw in the IPv4 networking code of the Linux kernel that carries a CVSS score of 9.8. While the vulnerable kernel versions are present in Fireware OS and WatchGuard AP, the company notes that the exploit chain does not work against those products. The only product still running a vulnerable Ubuntu base is Dimension, for which a patch is not yet available.

WatchGuard also released fixes for three critical authentication issues (CVE‑2026‑121639, CVE‑2026‑121638, and CVE‑2026‑121640) and a high‑severity integrity validation bug (CVE‑2026‑121637) in its AuthPoint Authentication Gateway. These flaws could allow attackers to bypass login checks or tamper with authentication data.

Cisco’s updates target a high‑severity vulnerability in UCS Central Software (CVE‑2026‑76506). That flaw could let an authenticated attacker execute arbitrary code remotely or expose sensitive information. Cisco also refreshed its advisory on CVE‑2026‑111497, known as Node2Shell, an out‑of‑bounds write error in Google’s Brotli compression library. The updated notice lists 19 Cisco products and notes that a dozen Splunk products are also affected. Both vendors say they have not observed exploitation in the wild.

SonicWall leaves GMS vulnerabilities unpatched

The same SecurityWeek report notes that SonicWall warned about two vulnerabilities in its legacy Global Management System (GMS), which reached end‑of‑life in October 2025. The first, CVE‑2026‑109593, is a critical‑severity file‑read bug that can be triggered without authentication. The second, CVE‑2026‑109594, is a medium‑severity SQL injection that could let an attacker read or modify data in the GMS database. SonicWall confirmed that no patches will be released for these issues.

Because GMS is no longer supported, organizations that continue to run it do so at increased risk. The lack of a fix means that attackers who discover the flaws could gain persistent access to configuration data, potentially compromising the entire security appliance fleet managed through GMS.

Impact on small businesses, nonprofits, and public‑sector teams

For most of our readers, the immediate concern is whether any of the patched products are in use. Cisco UCS Central is common in data‑center environments, while WatchGuard firewalls and authentication gateways are popular with small‑to‑medium enterprises and remote‑work setups. If your network includes any of these devices, the unpatched vulnerabilities could allow a remote attacker to execute code, steal credentials, or alter security policies.

The SonicWall situation is a reminder that legacy management platforms can become an open door. Even if the core firewall firmware is up‑to‑date, an unpatched management console can undermine those protections. Many nonprofits and municipal IT teams still rely on older appliances to stretch limited budgets, making the GMS exposure especially relevant.

Practical steps to protect your environment

• Apply the Cisco and WatchGuard patches today. Download the updates from the vendors’ official portals and schedule a maintenance window that minimizes user impact.
• Verify firmware versions. Confirm that your WatchGuard devices are no longer running the vulnerable Linux kernel or the Dimension appliance that still lacks a fix.
• Review authentication settings. After applying the AuthPoint patches, enforce strong passwords or multi‑factor authentication for all administrative accounts.
• Audit any SonicWall GMS installations. If you still run GMS, isolate the system from the internet, restrict access to trusted IP ranges, and consider migrating to a supported management solution.
• Conduct a vulnerability scan. Use a reputable external scanner to confirm that the patched vulnerabilities are no longer present and to discover any other gaps.
• Document and test incident response. Update your playbooks to include the new CVEs and run tabletop exercises to ensure your team knows how to respond if an attempt is detected.

By moving quickly to install the released patches and by tightening controls around legacy management tools, you can reduce the window of opportunity for attackers. Keeping software up to date and limiting exposure of unsupported platforms are core components of a resilient security posture.

For a deeper look at how exposed your own site might be, start with a free external scan on our security page.