Two Cisco items from SecurityWeek this week. I covered SonicWall’s GMS flaws in 2728.
UCS Central: CVE-2026-76506
A high-severity bug in UCS Central Software that could let an authenticated attacker run arbitrary code remotely or leak information. Cisco says it’s not aware of exploitation. Patch it.
Node2Shell: 19 Cisco products
Cisco updated its advisory for CVE-2026-111497, the exploited out-of-bounds write in Google’s Brotli library also called HTTP2Shell and Broccoli2Shell. 19 Cisco products are now confirmed affected, dozens more are under investigation, and nearly a dozen Splunk products are hit too.
My take
Node2Shell keeps growing because Brotli is everywhere. Check Cisco’s advisory against what you run, and keep checking, since the list isn’t final.
God Bless, and Happy hacking!
