# Multi-vendor vulnerability roundup: Node2Shell Brotli RCE (CVE-2026-111497, actively exploited, CISA KEV), WatchGuard CVE-2026-98432 (CVSS 9.8) and AuthPoint Gateway flaws, Cisco UCS Central CVE-2026-76506, SonicWall GMS CVE-2026-109593/109594 unpatched (EOL)

> Between 3 and 5 November 2026 WatchGuard, Cisco and SonicWall disclosed a cluster of critical flaws. The Brotli decoder out-of-bounds write 'Node2Shell' (CVE-2026-111497) is actively exploited and on the CISA KEV catalog, while SonicWall will not patch two end-of-life GMS flaws, including an unauthenticated file read (CVE-2026-109593).

- **Published:** 2026-11-06T04:34:39Z
- **Last reviewed:** 2026-11-06T04:34:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5372
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5372.png
- **ID:** TL-2026-5372
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)
- **CVEs:** CVE-2026-111497, CVE-2026-98432, CVE-2026-121639, CVE-2026-121638, CVE-2026-121640, CVE-2026-121637, CVE-2026-76506, CVE-2026-109593, CVE-2026-109594

## Description

SecurityWeek (2026-11-05) summarises vendor advisories from WatchGuard, Cisco and SonicWall. This record bundles them; only CVE-2026-111497 has confirmed in-the-wild exploitation.

Node2Shell / HTTP2Shell / Broccoli2Shell (CVE-2026-111497, CVSS v4 9.2): an out-of-bounds write in the Google Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous failure value when a compressed stream requests an invalid block-type switch. The decoder fast path does not handle that return value (CWE-252 unchecked return value leading to CWE-787 out-of-bounds write), so decoding continues with corrupted internal state. Any application that decompresses attacker-controlled Brotli data (HTTP responses or request bodies) can be driven to memory corruption, denial of service, information disclosure or remote code execution. The fix was committed to google/brotli on 2026-02-27 without a release or advisory. Node.js disclosed it on 2026-10-21 (fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; Brotli 1.0.10, 1.1.1 and 1.2.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0). Microsoft shipped an out-of-band .NET update on 2026-10-25 (8.0.33, 9.0.22, 10.0.14, 11 RC3). Imperva demonstrated RCE and named the bug. A public PoC targets Node.js 24.22.0 Linux builds and is probabilistic, sometimes needing retries. CISA added the CVE to KEV on 2026-10-27. ELLIO reported exploit traffic carrying the public exploit from 94.154.43.7, an address that had previously distributed PHP2Shell exploits and scanned VPN and Kubernetes services. Other projects that patched: Bun, Envoy Proxy, Istio, PHP, FFmpeg, Apache Arrow, ClickHouse. Cisco rates it High and, per SecurityWeek, 19 Cisco products are affected with dozens more under investigation; nearly a dozen Splunk products are also reported affected. I could not verify the Cisco and Splunk product lists from the vendor advisories.

WatchGuard: CVE-2026-98432 (WGSA-2026-0033, CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a use-after-free in the Linux kernel IPv4 code. inet_opt and ireq_opt are freed without proper RCU synchronisation, allowing concurrent access during TCP handshake processing (request socket migration and SYNACK retransmission), reachable via retransmitted SYN packets carrying IPv4 Record Route or Timestamp options. WatchGuard lists Fireware OS (2025.1 and >= 12.0), WatchGuard AP (>= 1.0) and Dimension (>= 2.0) as affected and shows no fixed versions yet; per SecurityWeek the flaw is not exploitable in the Fireware OS and AP products, and no exploitation has been detected. AuthPoint Authentication Gateway (>= 1.0, < 7.6.0, fixed in 7.6.0, published 2026-11-04): CVE-2026-121639 (9.2, improper authentication allows unauthenticated DoS), CVE-2026-121638 (9.1, improper certificate validation allows MitM), CVE-2026-121640 (9.1, capture-replay allows unauthorized administrative actions), CVE-2026-121637 (8.9, improper HMAC validation in the LDAP authentication callback allows forged authentication results). SecurityWeek labels the first three critical and the last high.

Cisco: CVE-2026-76506 affects UCS Central Software, is rated high, needs authentication, and allows remote code execution and information disclosure; it is patched. The article reports no exploitation.

SonicWall: Global Management System (GMS) 9.5.2 and earlier (Windows and Linux) reached end-of-life in October 2025. SNWLID-2026-0019 (published 2026-11-03, credited to Matei Badanoiu and Andrei Lungu of Pentest-Tools.com) covers CVE-2026-109593 (CVSS 3.1 9.1, CWE-636, unauthenticated read of internal GMS files) and CVE-2026-109594 (CVSS 6.8, CWE-89, post-authentication SQL injection with scope change). Per SecurityWeek, neither will be patched. Neither is on KEV.

No threat-actor attribution and no malware or C2 infrastructure beyond the single scanning/exploitation IP are reported.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1557 Adversary-in-the-Middle
- T1212 Exploitation for Credential Access
- T1005 Data from Local System
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Obtain Capabilities: Exploits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Node2Shell CVE-2026-111497 — Node.js/Bun Runtime Spawning Shell or Downloader (Exploitation)** (`TL-2026-5372-SPL-001`)

Detects a Node.js or Bun process spawning a shell, downloader or netcat child on Linux. After the Brotli decoder out-of-bounds write (CVE-2026-111497, Node2Shell, CISA KEV) is triggered by a malformed Brotli stream with an invalid block-type switch, the public PoC lands code execution inside the node process, which then starts a shell. Web-facing Node services rarely spawn interactive shells, so this is a high-signal behavioural indicator (T1190, T1203, T1059.004). Requires Sysmon for Linux process-creation telemetry.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203, T1059.004
- **Data sources:** sysmon_for_linux, linux_process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h (ParentImage="*/node" OR ParentImage="*/nodejs" OR ParentImage="*/bun") (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/busybox" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat") NOT (ParentCommandLine="*npm*" OR ParentCommandLine="*yarn*" OR ParentCommandLine="*pnpm*" OR ParentCommandLine="*node-gyp*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_commands values(ParentCommandLine) as node_command by host User ParentImage Image | convert ctime(first_seen) ctime(last_seen) | sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('node','nodejs','bun')
| where FileName in~ ('sh','bash','dash','busybox','curl','wget','nc','ncat')
| where not(InitiatingProcessCommandLine has_any ('npm','yarn','pnpm','node-gyp'))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Node.js Runtime Spawning Shell or Downloader - Node2Shell CVE-2026-111497
id: 53720001-9a1c-4e5b-8d10-5372d0e70001
status: experimental
description: Detects a Node.js or Bun process spawning a shell, downloader or netcat child on Linux, the post-exploitation pattern of Node2Shell (CVE-2026-111497) Brotli decoder RCE.
references:
  - https://www.sophos.com/blog/node2shell-cve-2026-111497-in-active-exploitation
  - https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1203
  - attack.t1059.004
  - cve.2026.111497
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/nodejs'
      - '/bun'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/busybox'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  filter_build:
    ParentCommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'pnpm'
      - 'node-gyp'
  condition: selection_parent and selection_child and not filter_build
falsepositives:
  - Node.js applications that legitimately shell out (image processing, git, deployment scripts)
  - Build and CI jobs running node outside npm/yarn wrappers
level: high
```

**Known false positives:**

- Node.js applications that legitimately shell out via child_process (image processing, git, backup or deployment scripts)
- CI/CD runners and build jobs that invoke node directly rather than through npm, yarn or pnpm

**Tuning notes:** Baseline parent/child pairs per host for 7 days and add known-good child_process commands (for example git or convert) to the NOT clause. Prioritise internet-facing Node hosts and containers running Node.js 22.x < 22.23.4, 24.x < 24.22.1 or 26.x < 26.12.1. Adjust index and sourcetype to your Sysmon for Linux or auditd ingestion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Node2Shell Post-Exploitation — Reverse Shell and Downloader Commands from Node Runtime, Community Payload Hashes (locked: unlock with TL Creds)
- SonicWall GMS CVE-2026-109593 — Unauthenticated Internal File Read Attempts (locked: unlock with TL Creds)
- WatchGuard AuthPoint Gateway — Gateway Process Spawning Command Interpreter (locked: unlock with TL Creds)
- Node2Shell Post-Exploitation — Node Runtime Accessing Credentials and Cloud/Kubernetes Secrets (locked: unlock with TL Creds)
- Node2Shell Post-Exploitation — Persistence Commands Spawned by Node Runtime (locked: unlock with TL Creds)
- SonicWall GMS CVE-2026-109594 — SQL Injection Patterns Against GMS Web Paths (locked: unlock with TL Creds)
- Node2Shell CVE-2026-111497 — Node.js/Bun Native Crash Burst (Failed Probabilistic Exploit or DoS) (locked: unlock with TL Creds)
- Node2Shell Exploit Source [indicator] and Community Sibling Infrastructure — Network Contact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- IP address: `94.154.43[.]7`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cisco, WatchGuard Release Patches; SonicWall Won't Fix GMS Flaws (SecurityWeek)](https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/)
- [WatchGuard PSIRT advisories (WGSA-2026-0033 and AuthPoint Authentication Gateway)](https://psirt.watchguard.com/)
- [SonicWall PSIRT SNWLID-2026-0019 (GMS)](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019)
- [CVE-2026-109593 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109593.json)
- [CVE-2026-109594 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109594.json)
- [CVE-2026-98432 CVE record (Linux kernel IPv4 use-after-free)](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json)
- [Brotli bug reaches far beyond Node.js (CVE-2026-111497) - Help Net Security](https://www.helpnetsecurity.com/?p=389353)
- [Node2Shell puts Microsoft and Node.js on Brotli patch duty - CSO Online](https://www.csoonline.com/article/4241027/node2shell-puts-microsoft-and-node-js-on-brotli-patch-duty.html)
- [Node2Shell (CVE-2026-111497) in active exploitation - Sophos](https://www.sophos.com/blog/node2shell-cve-2026-111497-in-active-exploitation)
- [Response to CVE-2026-111497 (Brotli decoder, Node2Shell) - HackerOne](https://www.hackerone.com/security-updates/cve-2026-111497)
- [Cisco Security Advisories listing](https://sec.cloudapps.cisco.com/security/center/publicationListing.x)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5372