F5, Juniper Networks Patch Critical Vulnerabilities

F5 has released fixes for 11 vulnerabilities in NGINX, including two critical, unauthenticated flaws—CVE-2026-15176 and CVE-2026-93479—that can be triggered through specially crafted HTTP requests to cause a buffer overflow and worker restart, potentially escalating to remote code execution if ASLR protections are off or bypassed. A third critical bug, CVE-2026-97205, can similarly corrupt memory or crash a worker process, with RCE possible under the same ASLR conditions. The other NGINX issues cover validation bypasses, data leaks, request spoofing, injection into proxied traffic, memory exhaustion, and unauthorized access to restricted paths.

Separately, Juniper Networks issued 17 advisories this week covering more than 150 vulnerabilities in Junos OS and Junos OS Evolved, plus four additional flaws in Juniper Cloud-Native Router. Roughly twenty of these are critical, enabling root-level code or command execution, full device compromise, kernel panics, system crashes, Routing Engine reboots, service outages, and an off-by-one buffer overflow. Juniper also addressed several high-severity bugs tied to remote code execution and denial-of-service risks. Neither F5 nor Juniper has reported any of these flaws being actively exploited.