Multi-vendor vulnerability roundup: Node2Shell Brotli RCE (CVE-2026-111497, actively exploited, CISA KEV), WatchGuard CVE-2026-98432 (CVSS 9.8) and AuthPoint Gateway flaws, Cisco UCS Central CVE-2026-76506, SonicWall GMS CVE-2026-109593/109594 unpatched (EOL)

Key facts for Multi-vendor Node2Shell roundup

Detection coverage for Multi-vendor Node2Shell roundup

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5372 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Node2Shell CVE-2026-111497 — Node.js/Bun Runtime Spawning Shell or Downloader (Exploitation)

Detects a Node.js or Bun process spawning a shell, downloader or netcat child on Linux. After the Brotli decoder out-of-bounds write (CVE-2026-111497, Node2Shell, CISA KEV) is triggered by a malformed Brotli stream with an invalid block-type switch, the public PoC lands code execution inside the node process, which then starts a shell. Web-facing Node services rarely spawn interactive shells, so this is a high-signal behavioural indicator (T1190, T1203, T1059.004). Requires Sysmon for Linux process-creation telemetry.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1203, T1059.004
• Data sources: sysmon_for_linux, linux_process_creation
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h (ParentImage="*/node" OR ParentImage="*/nodejs" OR ParentImage="*/bun") (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/busybox" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat") NOT (ParentCommandLine="*npm*" OR ParentCommandLine="*yarn*" OR ParentCommandLine="*pnpm*" OR ParentCommandLine="*node-gyp*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_commands values(ParentCommandLine) as node_command by host User ParentImage Image | convert ctime(first_seen) ctime(last_seen) | sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('node','nodejs','bun')
| where FileName in~ ('sh','bash','dash','busybox','curl','wget','nc','ncat')
| where not(InitiatingProcessCommandLine has_any ('npm','yarn','pnpm','node-gyp'))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Node.js Runtime Spawning Shell or Downloader - Node2Shell CVE-2026-111497
id: 53720001-9a1c-4e5b-8d10-5372d0e70001
status: experimental
description: Detects a Node.js or Bun process spawning a shell, downloader or netcat child on Linux, the post-exploitation pattern of Node2Shell (CVE-2026-111497) Brotli decoder RCE.
references:
  - https://www.sophos.com/blog/node2shell-cve-2026-111497-in-active-exploitation
  - https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1203
  - attack.t1059.004
  - cve.2026.111497
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/nodejs'
      - '/bun'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/busybox'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  filter_build:
    ParentCommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'pnpm'
      - 'node-gyp'
  condition: selection_parent and selection_child and not filter_build
falsepositives:
  - Node.js applications that legitimately shell out (image processing, git, deployment scripts)
  - Build and CI jobs running node outside npm/yarn wrappers
level: high

Known false positives:

• Node.js applications that legitimately shell out via child_process (image processing, git, backup or deployment scripts)
• CI/CD runners and build jobs that invoke node directly rather than through npm, yarn or pnpm

Tuning notes: Baseline parent/child pairs per host for 7 days and add known-good child_process commands (for example git or convert) to the NOT clause. Prioritise internet-facing Node hosts and containers running Node.js 22.x < 22.23.4, 24.x < 24.22.1 or 26.x < 26.12.1. Adjust index and sourcetype to your Sysmon for Linux or auditd ingestion.

• 🔒 Node2Shell Post-Exploitation — Reverse Shell and Downloader Commands from Node Runtime, Community Payload Hashes · unlock with TL Creds
• 🔒 SonicWall GMS CVE-2026-109593 — Unauthenticated Internal File Read Attempts · unlock with TL Creds
• 🔒 WatchGuard AuthPoint Gateway — Gateway Process Spawning Command Interpreter · unlock with TL Creds
• 🔒 Node2Shell Post-Exploitation — Node Runtime Accessing Credentials and Cloud/Kubernetes Secrets · unlock with TL Creds
• 🔒 Node2Shell Post-Exploitation — Persistence Commands Spawned by Node Runtime · unlock with TL Creds
• 🔒 SonicWall GMS CVE-2026-109594 — SQL Injection Patterns Against GMS Web Paths · unlock with TL Creds
• 🔒 Node2Shell CVE-2026-111497 — Node.js/Bun Native Crash Burst (Failed Probabilistic Exploit or DoS) · unlock with TL Creds
• 🔒 Node2Shell Exploit Source [indicator] and Community Sibling Infrastructure — Network Contact · unlock with TL Creds

Indicators of compromise for Multi-vendor Node2Shell roundup

As of 2026-11-06, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5372.

Sample indicators (1 of 13)

• IP address: 94.154.43[.]7

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How Multi-vendor Node2Shell roundup works

SecurityWeek (2026-11-05) summarises vendor advisories from WatchGuard, Cisco and SonicWall. This record bundles them; only CVE-2026-111497 has confirmed in-the-wild exploitation.

Node2Shell / HTTP2Shell / Broccoli2Shell (CVE-2026-111497, CVSS v4 9.2): an out-of-bounds write in the Google Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous failure value when a compressed stream requests an invalid block-type switch. The decoder fast path does not handle that return value (CWE-252 unchecked return value leading to CWE-787 out-of-bounds write), so decoding continues with corrupted internal state. Any application that decompresses attacker-controlled Brotli data (HTTP responses or request bodies) can be driven to memory corruption, denial of service, information disclosure or remote code execution. The fix was committed to google/brotli on 2026-02-27 without a release or advisory. Node.js disclosed it on 2026-10-21 (fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; Brotli 1.0.10, 1.1.1 and 1.2.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0). Microsoft shipped an out-of-band .NET update on 2026-10-25 (8.0.33, 9.0.22, 10.0.14, 11 RC3). Imperva demonstrated RCE and named the bug. A public PoC targets Node.js 24.22.0 Linux builds and is probabilistic, sometimes needing retries. CISA added the CVE to KEV on 2026-10-27. ELLIO reported exploit traffic carrying the public exploit from 94.154.43.7, an address that had previously distributed PHP2Shell exploits and scanned VPN and Kubernetes services. Other projects that patched: Bun, Envoy Proxy, Istio, PHP, FFmpeg, Apache Arrow, ClickHouse. Cisco rates it High and, per SecurityWeek, 19 Cisco products are affected with dozens more under investigation; nearly a dozen Splunk products are also reported affected. I could not verify the Cisco and Splunk product lists from the vendor advisories.

WatchGuard: CVE-2026-98432 (WGSA-2026-0033, CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a use-after-free in the Linux kernel IPv4 code. inet_opt and ireq_opt are freed without proper RCU synchronisation, allowing concurrent access during TCP handshake processing (request socket migration and SYNACK retransmission), reachable via retransmitted SYN packets carrying IPv4 Record Route or Timestamp options. WatchGuard lists Fireware OS (2025.1 and >= 12.0), WatchGuard AP (>= 1.0) and Dimension (>= 2.0) as affected and shows no fixed versions yet; per SecurityWeek the flaw is not exploitable in the Fireware OS and AP products, and no exploitation has been detected. AuthPoint Authentication Gateway (>= 1.0, < 7.6.0, fixed in 7.6.0, published 2026-11-04): CVE-2026-121639 (9.2, improper authentication allows unauthenticated DoS), CVE-2026-121638 (9.1, improper certificate validation allows MitM), CVE-2026-121640 (9.1, capture-replay allows unauthorized administrative actions), CVE-2026-121637 (8.9, improper HMAC validation in the LDAP authentication callback allows forged authentication results). SecurityWeek labels the first three critical and the last high.

Cisco: CVE-2026-76506 affects UCS Central Software, is rated high, needs authentication, and allows remote code execution and information disclosure; it is patched. The article reports no exploitation.

SonicWall: Global Management System (GMS) 9.5.2 and earlier (Windows and Linux) reached end-of-life in October 2025. SNWLID-2026-0019 (published 2026-11-03, credited to Matei Badanoiu and Andrei Lungu of Pentest-Tools.com) covers CVE-2026-109593 (CVSS 3.1 9.1, CWE-636, unauthenticated read of internal GMS files) and CVE-2026-109594 (CVSS 6.8, CWE-89, post-authentication SQL injection with scope change). Per SecurityWeek, neither will be patched. Neither is on KEV.

No threat-actor attribution and no malware or C2 infrastructure beyond the single scanning/exploitation IP are reported.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1557 Adversary-in-the-Middle

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for Multi-vendor Node2Shell roundup

Patches

• Brotli 1.0.10, 1.1.1 or 1.2.1
• Node.js 22.23.4, 24.22.1 or 26.12.1
• .NET 8.0.33, 9.0.22, 10.0.14 (11 RC3)
• Python Brotli 1.2.1 and brotlicffi 1.2.1.0
• WatchGuard AuthPoint Authentication Gateway 7.6.0
• Cisco UCS Central Software fixed release per Cisco advisory for CVE-2026-76506
• Linux kernel 5.10.272+, 5.15.223+, 6.1.190+, 6.6.159+, 7.3+ for CVE-2026-98432 (WatchGuard fixed versions not yet listed)

Immediate actions

• Inventory every application and appliance that decompresses untrusted Brotli data (Node.js, .NET, Python, PHP, Bun, Envoy, Istio, FFmpeg, ClickHouse, Apache Arrow) and prioritise internet-facing ones
• Treat CVE-2026-111497 as KEV-listed: patch within the CISA deadline and review logs for exploit traffic, including connections from 94.154.43.7
• Restrict network access to SonicWall GMS 9.5.2 and earlier to trusted management networks only, or take it offline
• Upgrade WatchGuard AuthPoint Authentication Gateway to 7.6.0 or later

Workarounds

• Where patching Node.js or Brotli consumers is not immediately possible, block or filter Brotli content-encoding from untrusted sources at a proxy or WAF
• Isolate WatchGuard Dimension, Fireware OS and AP management interfaces from untrusted networks until fixes are published

Longer-term hardening

• Migrate off SonicWall GMS, which is end-of-life since October 2025 and will not receive fixes for CVE-2026-109593 or CVE-2026-109594
• Maintain a software bill of materials so bundled libraries such as Brotli can be located quickly
• Monitor vendor PSIRT feeds for WatchGuard (WGSA-2026-0033), Cisco and Splunk advisories covering CVE-2026-111497

Affected and fixed versions

• Google — Brotli
  Vulnerable versions: 1.0.3 through 1.2.0 (before 1.0.10, 1.1.1, 1.2.1)
  Fixed in: 1.0.10; 1.1.1; 1.2.1
• OpenJS Foundation — Node.js
  Vulnerable versions: 22.x; 24.x; 26.x; end-of-life 20.x, 23.x, 25.x
  Fixed in: 22.23.4; 24.22.1; 26.12.1
• Microsoft — .NET
  Vulnerable versions: 8.0; 9.0; 10.0
  Fixed in: 8.0.33; 9.0.22; 10.0.14; 11 RC3
• Python — Brotli / brotlicffi
  Vulnerable versions: before 1.2.1 / 1.2.1.0
  Fixed in: Brotli 1.2.1; brotlicffi 1.2.1.0
• Cisco — 19 products affected by CVE-2026-111497 (per SecurityWeek; list not verified)
  Vulnerable versions: see Cisco advisory
  Fixed in: see Cisco advisory
• Cisco — UCS Central Software (CVE-2026-76506)
  Vulnerable versions: see Cisco advisory
  Fixed in: see Cisco advisory
• Splunk — Nearly a dozen products affected by CVE-2026-111497 (per SecurityWeek; list not verified)
  Vulnerable versions: see Splunk advisory
  Fixed in: see Splunk advisory
• WatchGuard — Fireware OS
  Vulnerable versions: 2025.1; >= 12.0 (CVE-2026-98432)
• WatchGuard — WatchGuard AP
  Vulnerable versions: >= 1.0 (CVE-2026-98432)
• WatchGuard — Dimension
  Vulnerable versions: >= 2.0 (CVE-2026-98432)

Timeline of Multi-vendor Node2Shell roundup

• 2026-02-27 Fix for the Brotli decoder flaw committed to google/brotli without a release or advisory
• 2026-10-15 CVE-2026-98432 (Linux kernel IPv4 use-after-free, CVSS 9.8) published
• 2026-10-21 Node.js publicly discloses CVE-2026-111497 (Node2Shell) and ships Node.js 22.23.4, 24.22.1 and 26.12.1
• 2026-10-25 Microsoft releases an out-of-band .NET update (8.0.33, 9.0.22, 10.0.14, 11 RC3) for CVE-2026-111497
• 2026-10-27 CISA adds CVE-2026-111497 to the Known Exploited Vulnerabilities catalog
• 2026-10-28 locked-ioc-13 sensors record CVE-2026-111497 exploit traffic in the wild from locked-ioc-10
• 2026-11-03 SonicWall publishes SNWLID-2026-0019 (GMS CVE-2026-109593/109594, no fix) and WatchGuard publishes WGSA-2026-0033 for CVE-2026-98432 with no fixed versions listed
• 2026-11-04 WatchGuard publishes four AuthPoint Authentication Gateway advisories, fixed in 7.6.0
• 2026-11-05 SecurityWeek reports the Cisco and WatchGuard patches and SonicWall's refusal to fix the end-of-life GMS flaws

Sources cited for Multi-vendor Node2Shell roundup

• CVE-2026-109593 CVE record raw.githubusercontent.com · Advisory · 2026-11-03
• CVE-2026-109594 CVE record raw.githubusercontent.com · Advisory · 2026-11-03
• CVE-2026-98432 CVE record (Linux kernel IPv4 use-after-free) raw.githubusercontent.com · Advisory · 2026-10-15
• WatchGuard PSIRT advisories (WGSA-2026-0033 and AuthPoint Authentication Gateway) psirt.watchguard.com · Vendor report · 2026-11-03
• SonicWall PSIRT SNWLID-2026-0019 (GMS) psirt.global.sonicwall.com · Vendor report · 2026-11-03
• Response to CVE-2026-111497 (Brotli decoder, Node2Shell) - HackerOne hackerone.com · Vendor report · 2026-11-02
• Cisco Security Advisories listing Cisco · Vendor report · 2026-11-05
• Node2Shell (CVE-2026-111497) in active exploitation - Sophos Sophos · Blog
• Cisco, WatchGuard Release Patches; SonicWall Won't Fix GMS Flaws (SecurityWeek) SecurityWeek · News · 2026-11-05
• Brotli bug reaches far beyond Node.js (CVE-2026-111497) - Help Net Security Help Net Security · News
• Node2Shell puts Microsoft and Node.js on Brotli patch duty - CSO Online csoonline.com · News

More in vulnerability

• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)
• Claude Dispatch "ThisBash" flaw lets malicious browser extensions drive Claude Desktop to execute commands locally or on other machines on the same account; Anthropic has not fixed it
• Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)
• Marimo CVE-2026-39987: unauthenticated /terminal/ws RCE exploited to harvest AWS credentials and pivot to an SSH bastion in 8 seconds
• Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers