F5 and Juniper Patch Critical RCE Flaws in NGINX and Junos OS

F5 and Juniper Networks have released security updates addressing dozens of vulnerabilities, including critical remote code execution flaws. F5 announced fixes for 11 defects in NGINX, while Juniper published advisories covering more than 150 issues in Junos OS and Junos OS Evolved. These patches address severe security gaps that could allow attackers to take full control of affected devices.

How it unfolded

• F5 released patches for 11 security defects in its NGINX products, including three critical-severity issues.
• Juniper Networks published 17 advisories detailing over 150 security defects across Junos OS and Junos OS Evolved.
• Juniper also addressed four bugs in the Juniper Cloud-Native Router, bringing the total count of patched flaws into the hundreds.

Who is affected

F5’s NGINX products are affected by CVE-2026-15176 and CVE-2026-93479, which allow unauthenticated attackers to trigger buffer overflows via crafted HTTP requests. According to SecurityWeek, exploitation can lead to remote code execution if Address Space Layout Randomization is disabled or bypassed. Another critical flaw, CVE-2026-97205, causes memory corruption or worker process termination, potentially leading to RCE under similar conditions.

Juniper Networks’ Junos OS and Junos OS Evolved contain approximately two dozen critical-severity flaws that enable code execution with root privileges. These defects can result in complete device takeover, kernel panics, or routing engine reboots. The Juniper Cloud-Native Router also has four patched bugs. Additional high-severity issues in both vendors’ products could lead to denial-of-service attacks or other disruptions.

Our take on the response

Both vendors have provided patches for these critical vulnerabilities, allowing administrators to remediate the risks immediately. The absence of reported wild exploitation suggests these flaws have not yet been widely weaponized, but the potential for unauthenticated remote code execution remains severe. Organizations should treat these updates as urgent priorities to prevent potential full device compromise.

Who needs to act first

Teams usually prioritize internet-facing systems that handle untrusted traffic, as these are most vulnerable to unauthenticated attacks. Check whether critical services like NGINX or Junos OS are exposed to the public internet before applying patches. Test updates in a non-production environment to ensure stability, then roll them out to critical infrastructure first. Back up configurations before making changes to facilitate quick recovery if issues arise during the patching process.

What to do and how to stay safe: F5

• Verify inventory of all NGINX and Junos OS instances to identify systems running vulnerable versions.
• Apply the latest security patches from F5 and Juniper Networks as soon as testing confirms stability.
• Monitor network logs for unusual HTTP requests or signs of buffer overflow attempts on affected servers.
• Ensure Address Space Layout Randomization is enabled on systems where immediate patching is not possible.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are these vulnerabilities being exploited in the wild?

F5 and Juniper Networks have not reported any evidence of active exploitation for these specific vulnerabilities.

Which CVEs are considered critical in F5's NGINX update?

CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205 are rated as critical-severity issues.

How many vulnerabilities did Juniper Networks patch?

Juniper Networks addressed over 150 security defects in Junos OS and Junos OS Evolved, plus four in JCNR.