Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
CVE-2026-15176 * CVE-2026-93479 * CVE-2026-97205 * F5 NGINX US
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
EPSS 0.01 CVSS 9.2 CVE-2026-101019 CVE-2026-101025 CVE-2026-104939 CVE-2026-15176 CVE-2026-91184 CVE-2026-93479 CVE-2026-94197 CVE-2026-95101 CVE-2026-96615 CVE-2026-97205 CVE-2026-97629 F5 NGINX FR FI
Serial number: AV26-1049 Date: October 15, 2026 As of October 14, 2026, F5 is affected by vulnerabilities in the following products: NGINX Gateway Fabric Prior to 2.8.0 NGINX Ingress Controller Prior to 5.7.0 NGINX JavaScript Prior to 1.0.2 NGINX Open Source Prior to 1.30.6 Prior to 1.31.7 NGINX Plus Prior to 37.0.5.1 Prior to 37.1.0.1 Versions R33 to R36 NGINX Instance Manager Prior to 2.24.0 F5 WAF for NGINX Prior to 5.16.0 Prior to 5.14.2 F5 DoS for NGINX Prior to 4.11.0 The Cyber Centre…
EPSS 0.01 CVE-2026-101019 CVE-2026-104939 CVE-2026-15176 F5 CA
F5 ha rilasciato aggiornamenti di sicurezza che sanano alcune vulnerabilità, di cui 3 con gravità "critica" e 6 con gravità "alta", in prodotti NGINX, noto software per la gestione del traffico e degli applicativi web.
EPSS 0.01 CVE-2026-101019 CVE-2026-104939 CVE-2026-15176 CVE-2026-91184 CVE-2026-93479 CVE-2026-94197 CVE-2026-96615 CVE-2026-97205 CVE-2026-97629 F5 IT
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
EPSS 0.01 CVE-2026-15176 CVE-2026-93479 CVE-2026-95101 CVE-2026-97205 CVE-2026-97629 F5 FR
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the ShinyHunters group defaced the website. The group claimed to have stolen employee and applicant information and shared samples of purported FBI personnel records with several media organizations. Astrana Health, a major US healthcare technology provider, has confirmed a…
KEV ✓ EPSS 0.96 CVSS 9.8 CVE-2026-85102 CVE-2026-87902 CVE-2026-93616 CVE-2026-94127 Check Point F5 WordPress IL
24. September 2026 Beschreibung In der OAuth Komponente von F5 BIG-IP APM existiert eine kritische Schwachstelle, welche dass unauthentifizierte Ausführen von Schadcode aus der Ferne erlaubt. Betroffen sind Systeme, welche BIG-IP APM als Authorisierungsserver via OAuth-Funktionalität nutzen. Es liegen Informationen vor, dass diese Lücke bereits aktiv ausgenutzt wird, daher empfiehlt sich die Überprüfung der eigenen Instanzen auf etwaige Indicators of Compromise, welche ebenfalls im…
KEV ✓ EPSS 0.27 CVSS 9.8 CVE-2026-94127 F5 AT RO SE US HU FR CA IT
On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible.
F5 EU
F5 Networks heeft een kwetsbaarheid verholpen in BIG-IP Access Policy Manager (APM). De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende in staat om malafide code uit te voeren. Hiertoe dient de kwaadwillende malafide netwerkverkeer naar het kwetsbare systeem te versturen. BIG-IP APM-systemen zijn alleen kwetsbaar wanneer een access policy en een OAuth-profiel op de virtuele server zijn geconfigureerd. F5 Networks geeft aan dat het een zeroday-kwetsbaarheid is die actief wordt misbruikt.
F5 NL
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.5, CVEs: CVE-2026-90439, Summary: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions 3.5.0 and earlier under certain configurations, a limited heap buffer overflow could happen while processing a Transport Layer Security (TLS) handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This…
EPSS 0.00 CVSS 6.5 CVE-2026-90439 NGINX OpenSSL F5 FI FR
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]
KEV ✓ EPSS 0.02 CVE-2025-53521 F5 US FR
Serial Number: AV26-878Date: September 3, 2026 As of September 2, 2026, F5 is affected by vulnerabilities in the following products: BIG-IP (all modules) Prior to 17.1.3.4 Prior to 17.5.1.8 Prior to 21.0.0.3 Prior to 21.1.0.1 BIG-IQ Prior to 8.4.2.1 NGINX Gateway Fabric Prior to 2.6.8 NGINX Ingress Controller Prior to 2026-lts-r5 Prior to 5.6.0 NGINX JavaScript 9.9 Prior to 1.0.1 APM Clients Prior to 7.2.6 BIG-IP APM Multiple versions The Cyber Centre encourages users and administrators to…
F5 CA
F5 ha rilasciato aggiornamenti di sicurezza che sanano 5 nuove vulnerabilità, di cui una con gravità "critica" e 4 con gravità “alta”, in prodotti NGINX, noto software per la gestione del traffico e degli applicativi web.
EPSS 0.01 CVE-2026-18329 CVE-2026-66362 CVE-2026-77180 CVE-2026-78222 CVE-2026-78689 F5 NGINX IT
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
EPSS 0.01 CVE-2026-18329 CVE-2026-33278 CVE-2026-42959 CVE-2026-63020 CVE-2026-66362 CVE-2026-66842 CVE-2026-77180 CVE-2026-78222 CVE-2026-78689 F5 FR
Byla identifikována aktivně zneužívána kritická zranitelnost umožňující neautentizované vzdálené spuštění kódu (RCE) v komponentě apmd produktu F5 BIG‑IP APM.
F5 CZ
The NCSC is encouraging UK organisations to mitigate an unauthenticated remote code execution vulnerability affecting F5 BIG-IP Access Policy Manager.
F5 GB