Threat database

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42930 is a high-severity vulnerability in F5 BIG-IP systems running in Appliance mode. It allows an authenticated attacker with the 'Administrator' role to bypass Appliance mode restrictions by exploiting a path traversal issue (CWE-35). This vulnerability affects multiple BIG-IP versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42406 is a high-severity vulnerability in F5 BIG-IP and BIG-IQ systems. It allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects that enable running arbitrary commands. This vulnerability affects multiple versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.

An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-32643 is a high-severity vulnerability in F5 BIG-IP and BIG-IQ systems. It allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects in a way that enables running arbitrary commands. This vulnerability affects multiple versions, including 21.0.0, 17.5.0, 17.1.0, and 16.1.

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-32673 is a vulnerability in F5 BIG-IP scripted monitors that allows an authenticated user with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges. In appliance mode, exploitation can enable crossing security boundaries. The vulnerability affects multiple BIG-IP versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-34176 is a high-severity vulnerability in F5 BIG-IP appliances running in Appliance mode. It involves an authenticated remote OS command injection via an undisclosed iControl REST endpoint. Successful exploitation allows an attacker with high privileges to cross security boundaries, potentially leading to full compromise of confidentiality and integrity without impacting availability. The vulnerability affects specific versions including 21.0.0, 17.5.0, 17.1.0, and 16.

A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41225 is a high-severity vulnerability in F5 BIG-IP's iControl REST interface. It allows a highly privileged, authenticated attacker with at least Manager role permissions to create configuration objects that enable execution of arbitrary commands. This vulnerability affects specific versions of BIG-IP including 21.0.0, 17.5.0, 17.1.0, and 16.1.

CVE-2026-39459 is a high-severity vulnerability in F5 BIG-IP affecting iControl REST and TMOS Shell (tmsh). It allows a highly privileged, authenticated attacker with at least the Manager role to create configuration objects that enable running arbitrary commands. This violates the principle of least privilege and could lead to full system compromise. The affected versions include 16.1.0, 17.1.0, 17.5.0, and 21.

CVE-2026-41953 is a high-severity command injection vulnerability in F5 BIG-IP systems. It allows a highly privileged, authenticated attacker with at least Resource Administrator role to modify configuration objects, potentially leading to privilege escalation. The vulnerability affects multiple BIG-IP versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.

CVE-2026-40631 is a high-severity vulnerability in F5 BIG-IP affecting versions 16.1.0, 17.1.0, 17.5.0, and 21.0.0. An authenticated attacker with Resource Administrator or Administrator privileges can exploit the iControl SOAP interface to modify configuration objects, leading to privilege escalation.