F5, Juniper Networks Patch Critical Vulnerabilities

F5 patched 11 vulnerabilities in NGINX, including critical unauthenticated RCE flaws (CVE-2026-15176, CVE-2026-93479) exploitable via crafted HTTP requests that may cause buffer overflows and restarts, with potential RCE if ASLR is bypassed or disabled. Another critical bug (CVE-2026-97205) could cause memory corruption or worker process termination, also leading to RCE under certain conditions. Juniper Networks issued 17 advisories covering over 150 security defects in Junos OS and Junos OS Evolved, plus four in Juniper Cloud-Native Router. About two dozen are critical, enabling root-level code execution, device takeover, kernel panics, crashes, and service disruptions. Multiple high-severity flaws also allow RCE and denial-of-service. Neither vendor reported active exploitation.

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code remotely, potentially resulting in full device takeover, service disruption, kernel panics, or crashes. This impacts network infrastructure and application delivery devices from F5 and Juniper Networks, which are critical for enterprise and service provider environments. No known active exploitation has been reported, but the critical severity indicates high risk if unpatched.

Patches have been released by F5 and Juniper Networks for all identified vulnerabilities. Organizations should apply these official fixes promptly to mitigate the risk of remote code execution and device compromise. There is no indication that any of these vulnerabilities are currently exploited in the wild. No additional mitigation steps beyond patching are specified by the vendors.