WatchGuard published five advisories this week and four of them describe critical bugs, but the one worth an evening of maintenance is a kernel issue with no fix yet for one product line.
The most severe is CVE-2026-98432, a use-after-free in the IPv4 networking code of the Linux kernel, scored 9.8. Fireware OS and the WatchGuard AP hardware ship vulnerable kernel versions but cannot be driven through the public exploit chain. Dimension runs an affected Ubuntu build and has no patch.
Three authentication flaws in AuthPoint Authentication Gateway also rate critical: CVE-2026-121639, CVE-2026-121638 and CVE-2026-121640, alongside an integrity validation gap, CVE-2026-121637.
The two edges of the same week
Cisco fixed CVE-2026-76506 in UCS Central Software, where an authenticated user could run code remotely or leak data. Cisco also widened its Brotli advisory to 19 products, with dozens more still under review.
SonicWall made the opposite call. Global Management System reached end of life in October 2025, and two bugs will never be patched: CVE-2026-109593, an unauthenticated file read rated 9.1, and CVE-2026-109594, a medium-severity SQL injection. The only remedy on offer is migration to Network Security Manager.
None of the three vendors reports exploitation of these specific flaws.
