F5 and Juniper Networks Release Patches for Critical Remote Code Execution Flaws

F5 and Juniper Networks have released software updates to fix dozens of security vulnerabilities across their respective product lines. According to SecurityWeek, these patches address critical-severity flaws that could allow attackers to execute code remotely and achieve full control of affected devices.

F5 announced fixes for 11 security defects in its NGINX products. Among these, CVE-2026-15176 and CVE-2026-93479 are rated critical because they can be exploited without authentication via crafted HTTP requests. An unauthenticated attacker could trigger a buffer overflow, potentially causing a restart. If Address Space Layout Randomization (ASLR) is disabled or bypassed, this could lead to remote code execution.

Another critical issue, CVE-2026-97205, could cause memory corruption or terminate the worker process. This flaw might also lead to remote code execution if ASLR is disabled. The remaining vulnerabilities in the F5 update could allow attackers to bypass verification, read sensitive information, spoof request attributes, or inject data into proxied requests.

Juniper Networks Vulnerabilities

Juniper Networks published 17 advisories detailing more than 150 security defects in Junos OS and Junos OS Evolved. The company also addressed four bugs in the Juniper Cloud-Native Router. Approximately two dozen of these flaws are critical-severity issues that lead to code or command execution with root privileges.

These critical Juniper flaws can result in complete device takeover, kernel panic, crashes, Routing Engine reboot, and service disruption. Some issues involve buffer overflows caused by off-by-one errors. Juniper also patched multiple high-severity security holes that could lead to remote code execution, denial-of-service attacks, and other types of security incidents.

Affected Systems and Status

F5 and Juniper Networks make no mention of any of these vulnerabilities being exploited in the wild. The updates cover a wide range of potential attack vectors, including the ability to access protected paths before authentication or cause unbounded memory growth. Security professionals should verify their environments against the specific CVEs listed in the vendor advisories.

What should you do?

Security teams should immediately review their inventory of F5 NGINX and Juniper networking equipment. Apply the latest patches provided by the vendors to mitigate the risk of unauthenticated remote code execution. Monitor logs for signs of exploitation, such as unexpected restarts or unauthorized access attempts, while waiting for any potential future updates.

What to do and how to stay safe: F5

• Audit your network devices to identify any instances of F5 NGINX or Juniper Junos OS that require patching.
• Apply the vendor-provided updates immediately to close the critical remote code execution vulnerabilities.
• Review system logs for indicators of compromise, such as buffer overflow errors or unexpected process terminations.
• Ensure Address Space Layout Randomization is enabled on affected systems to add a layer of defense against exploitation.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are these vulnerabilities currently being exploited in the wild?

No, neither F5 nor Juniper Networks has confirmed that these specific vulnerabilities are being exploited in the wild.

What is the severity of the F5 NGINX vulnerabilities?

F5 identified critical-severity bugs, including CVE-2026-15176 and CVE-2026-93479, which allow unauthenticated remote code execution.

How many vulnerabilities did Juniper Networks patch?

Juniper Networks published advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, plus four in JCNR.