F 5 and Juniper Networks have issued patches for a substantial set of vulnerabilities across their products, with several carrying critical severity due to remote code execution (RCE) potential. On the F5 side, fixes were released for 11 security defects in NGINX, including CVE-2026-15176 and CVE-2026-93479, both of which could be exploited without authentication via crafted HTTP requests.
In certain conditions, an unauthenticated attacker could trigger a buffer overflow and, if ASLR is disabled or bypassed, achieve RCE. A further critical issue, CVE-2026-97205, could cause memory corruption or worker process termination, or again lead to RCE if ASLR is disabled. The remaining flaws range from bypassing verification to reading sensitive information, spoofing attributes, data injection in proxied requests, unbounded memory growth, or access to protected paths before authentication.
Juniper Networks likewise released a slate of advisories, publishing 17 advisories covering over 150 defects in Junos OS, Junos OS Evolved, and four bugs in JCNR. Roughly two dozen of these are described as critical, potentially enabling code or command execution with root privileges, complete device takeover, kernel panic, or service disruption, including router and Routing Engine crashes or reboots. Neither vendor reports evidence of exploitation in the wild.
SecurityWeek notes that both F5 and Juniper also patched multiple high‑severity flaws capable of RCE, DoS, and related attacks. There is no indication that any of these vulnerabilities have been exploited in active operations at the time of reporting. Organisations using F5 NGINX deployments or Junos OS/JCNR should apply the relevant patches promptly and verify that mitigations and configurations (such as ASLR) are in place to reduce risk.