/
← Voltar ao feed
high

CERT-FR: Multiple F5 NGINX product vulnerabilities, including remote code execution, fixed in October 2026 bulletins

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 11 horas

CERT-FR advisory CERTFR-2026-AVI-1317 reports multiple vulnerabilities in F5 products, mainly the NGINX family, covered by F5 security bulletins published on October 14, 2026. Some of the flaws allow an attacker to achieve remote arbitrary code execution, compromise data confidentiality and integrity, and cause remote denial of service. Five CVEs are referenced. The advisory does not state that any flaw is actively exploited, and it gives no technical details, IOCs or attribution. Defenders running NGINX Open Source, NGINX Plus or the related NGINX modules and controllers should prioritize patching.

Technical Details

  • Affected products: F5 DoS for NGINX 4.x before 4.11.0, F5 WAF for NGINX 5.x before 5.16.0, NGINX Gateway Fabric 2.x before 2.8.0, NGINX Ingress Controller 5.x before 5.7.0, NGINX Instance Manager 2.x before 2.24.0, NGINX Open Source 1.x before 1.31.7, NGINX Plus 37.x before 37.2.0.
  • Referenced F5 bulletins: K000162416, K000162606, K000162607, K000162608 and K000162613.
  • The advisory does not map impacts to individual CVEs.

Remediation

  • Apply the fixed versions listed in the F5 security bulletins of October 14, 2026 for every affected NGINX product.
  • Inventory NGINX deployments, including Kubernetes ingress controllers, gateways and container images, to find vulnerable builds.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple F5 NGINX product vulnerabilities, including remote code execution, fixed in October 2026 bulletins

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1317 reports multiple vulnerabilities in F5 products, mainly the NGINX family, covered by F5 security bulletins published on October 14, 2026. Some of the flaws allow an attacker to achieve remote arbitrary code execution, compromise data confidentiality and integrity, and cause remote denial of service. Five CVEs are referenced. The advisory does not state that any flaw is actively exploited, and it gives no technical details, IOCs or attribution. Defenders running NGINX Open Source, NGINX Plus or the related NGINX modules and controllers should prioritize patching.

    Technical Details

    • Affected products: F5 DoS for NGINX 4.x before 4.11.0, F5 WAF for NGINX 5.x before 5.16.0, NGINX Gateway Fabric 2.x before 2.8.0, NGINX Ingress Controller 5.x before 5.7.0, NGINX Instance Manager 2.x before 2.24.0, NGINX Open Source 1.x before 1.31.7, NGINX Plus 37.x before 37.2.0.
    • Referenced F5 bulletins: K000162416, K000162606, K000162607, K000162608 and K000162613.
    • The advisory does not map impacts to individual CVEs.

    Remediation

    • Apply the fixed versions listed in the F5 security bulletins of October 14, 2026 for every affected NGINX product.
    • Inventory NGINX deployments, including Kubernetes ingress controllers, gateways and container images, to find vulnerable builds.