This week has seen a flurry of activity in the world of cybersecurity as two major vendors, Cisco and WatchGuard, released patches to fix critical vulnerabilities in their products. Meanwhile, SonicWall has admitted that it won’t be issuing fixes for similar flaws affecting its legacy centralized management platform.
The most severe vulnerability disclosed by WatchGuard affects the Linux kernel used in Fireware OS and WatchGuard AP. The issue, known as CVE-2026-98432, is a use-after-free bug with a CVSS score of 9.8, making it one of the most critical vulnerabilities in recent memory. However, WatchGuard has clarified that this vulnerability does not enable remote code execution (RCE) on its own, but rather opens the door to an RCE exploit chain.
The company also released patches for three critical authentication issues and a high-severity integrity validation bug affecting AuthPoint Authentication Gateway. These vulnerabilities could potentially allow attackers to gain unauthorized access to sensitive systems and data.
Cisco’s patching effort has been equally extensive, with fixes issued for CVE-2026-76506 – a high-severity vulnerability in UCS Central Software that allows authenticated attackers to execute arbitrary code remotely or leak information. Notably, Cisco also updated its advisory on Node2Shell, an out-of-bounds write flaw in Google’s Brotli data compression library, which has been causing headaches for organizations.
As it turns out, nearly a dozen Splunk products are affected by this vulnerability as well, and the company is still investigating dozens more. While both WatchGuard and Cisco have stated that they are not aware of any exploitation of these vulnerabilities in the wild, users would be wise to review their systems’ configuration and update their software immediately.
Meanwhile, SonicWall has announced that its legacy centralized management platform Global Management System (GMS) will remain vulnerable to two critical-severity flaws. The first, CVE-2026-109593, is a file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection vulnerability.
It’s worth noting that GMS has reached its End-of-Life (EOL) status in October 2025, which means it no longer receives security updates or patches. As such, users of this platform should consider upgrading to a more secure and supported solution as soon as possible.
In conclusion, the latest batch of vulnerability disclosures serves as a stark reminder that cybersecurity is an ongoing battle – one that requires vigilance and continuous updating of software and systems. Organizations would be wise to stay on top of security patches and updates, rather than waiting for vulnerabilities to be exploited in the wild.
Source: SecurityWeek — 2026-11-05