cyber.hendryadrian.com
Security News · securityweek.com

F5 and Juniper Patch Critical Vulnerabilities, Including RCE Flaws

· Original article ↗

Summary

F5 patched 11 NGINX flaws, including critical bugs that could allow unauthenticated RCE under certain conditions. Juniper issued 17 advisories covering over 150 defects in Junos products and four in JCNR. Neither company reported in-the-wild exploitation.

Key points

  • F5 fixed 11 NGINX vulnerabilities. Two critical flaws could be exploited without authentication via crafted HTTP requests; under certain conditions, exploitation could lead to RCE.
  • A third critical NGINX flaw could cause memory corruption or worker-process termination, and could lead to RCE if ASLR is disabled.
  • Other F5 flaws could enable information disclosure, validation bypasses, request spoofing or injection, memory growth, and access to protected paths before authentication.
  • Juniper published 17 advisories covering over 150 flaws in Junos OS and Junos OS Evolved, plus four flaws in Juniper Cloud-Native Router.
  • Juniper said roughly two dozen issues were critical and could cause outcomes including root-privilege code or command execution, device takeover, crashes, reboots, and service disruption.
  • F5 and Juniper did not mention any of the vulnerabilities being exploited in the wild.

Article Details

Event Type
F5 and Juniper Networks security patch releases
Impact
F5 patched 11 NGINX vulnerabilities, including three critical flaws: CVE-2026-15176 and CVE-2026-93479 could allow unauthenticated exploitation via crafted HTTP requests, potentially causing a buffer overflow and, if ASLR is disabled or bypassed, remote code execution; CVE-2026-97205 could cause memory corruption, worker-process termination, or remote code execution if ASLR is disabled. Juniper Networks issued 17 advisories covering more than 150 defects in Junos OS and Junos OS Evolved, plus four in Juniper Cloud-Native Router (JCNR). The reported potential impacts include privileged code or command execution, device takeover, kernel panic, crashes, Routing Engine reboots, service disruption, and denial of service. Neither company reported exploitation in the wild.

CVE

CVE-2026-15176Among them, CVE-2026-15176 and CVE-2026-93479 are critical-severity bugs that could be exploited without authentication via crafted HTTP requests.CVE-2026-93479Among them, CVE-2026-15176 and CVE-2026-93479 are critical-severity bugs that could be exploited without authentication via crafted HTTP requests.CVE-2026-97205Another critical issue, CVE-2026-97205, could cause memory corruption or the worker process to terminate, or could lead to RCE if ASLR is disabled.

Vendors

F5F5 and Juniper Networks have rolled out patches for dozens of vulnerabilities across their products, including critical-severity remote code execution (RCE) flaws.Juniper NetworksF5 and Juniper Networks have rolled out patches for dozens of vulnerabilities across their products, including critical-severity remote code execution (RCE) flaws.

Products

Juniper Cloud-Native Router (JCNR)This week, Juniper Networks published 17 advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, and four bugs in Juniper Cloud-Native Router (JCNR).Junos OSThis week, Juniper Networks published 17 advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, and four bugs in Juniper Cloud-Native Router (JCNR).Junos OS EvolvedThis week, Juniper Networks published 17 advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, and four bugs in Juniper Cloud-Native Router (JCNR).NGINXSecurity and application delivery firm F5 announced fixes for 11 security defects in NGINX.

Related Articles