F5

An authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller (NIC) allows remote attackers to spoof request attributes and access protected paths by manipulating unsanitized X-Forwarded-* headers.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

An unauthenticated remote code execution vulnerability (CVE-2026-94127) exists in F5 BIG-IP APM when an OAuth profile is configured on a virtual server, allowing attackers to execute arbitrary code via malformed traffic.

A vulnerability in F5 NGINX, tracked as CVE-2026-90439, allows remote attackers to trigger a denial of service and potentially compromise data integrity.

An authenticated user with any role can exploit a vulnerability in the F5 BIG-IP Traffic Management User Interface to create arbitrary administrative accounts.

An authentication bypass flaw in NGINX JavaScript (njs) and QuickJS (qjs) engines allows unauthenticated attackers to trigger a fail-open state in access control logic, potentially granting unauthorized access to protected resources.

An unauthenticated, remote attacker can exploit a vulnerability in F5 BIG-IP and BIG-IP Next to perform a Denial of Service attack, potentially disrupting services.

A denial-of-service vulnerability (CVE-2026-59762) exists in F5 BIG-IP systems when an HTTP/2 profile is configured on a virtual server, where undisclosed requests can lead to increased memory resource utilization, degrading system performance and potentially causing the TMM process to restart, allowing a remote, unauthenticated attacker to cause a denial-of-service condition affecting the data plane.

A heap buffer overflow vulnerability, CVE-2026-42533, exists in NGINX Plus and NGINX Open Source when a 'map' directive uses regex matching and references its capture variables before the map's output variable or uses a non-cacheable variable under certain conditions, allowing an unauthenticated attacker to send crafted HTTP requests causing denial-of-service or remote code execution.

An injection vulnerability, CVE-2026-50107, exists in the NGINX configuration generator component of NGINX Gateway Fabric when configured with NGINX Plus or NGINX Open Source as the data plane, allowing authenticated attackers with CRD modification permissions to inject arbitrary NGINX configuration directives via unsanitized user-supplied string values in the access log format setting, leading to control plane compromise and potential defense evasion or system impact.

Exploitation attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices via CVE-2020-5902 are detected through regex pattern matching of exploit strings and directory traversal sequences in syslog data, potentially leading to remote code execution and system compromise.

A vulnerability in Nginx allows a remote attacker to execute arbitrary code and cause a denial-of-service condition, affecting Nginx Open Source versions 1.x before 1.30.2, versions after 1.31.0 before 1.31.1, Nginx Plus versions 37.x before 37.0.1.1, and versions Rx before R36 P5 or R32 P7.

Multiple vulnerabilities in F5 BIG-IP products could allow an attacker to execute arbitrary code, gain elevated privileges, bypass security measures, manipulate or disclose data, or cause a denial-of-service condition.

CVE-2026-40061 is a vulnerability in F5 BIG-IP DNS that allows an authenticated attacker with Resource Administrator or Administrator privileges to execute arbitrary system commands with elevated privileges via undisclosed iControl REST and TMOS Shell (tmsh) commands, potentially crossing security boundaries in Appliance mode deployments.

CVE-2026-32643 describes a vulnerability in F5 BIG-IP and BIG-IQ systems that allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects, leading to arbitrary command execution.

F5 has reclassified CVE-2025-53521, a vulnerability in BIG-IP APM, as a critical unauthenticated remote code execution vulnerability and reports it is being actively exploited in the wild.

Exploitation of CVE-2023-46747, an authentication bypass vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI), allows unauthorized access and potentially leads to remote code execution.

This brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.