F5 and Juniper Networks have issued patches for dozens of vulnerabilities across their products, including critical-severity remote code execution (RCE) flaws.
Security delivery company and application F5 announced Fixed 11 security flaws in NGINX. Among them, CVE-2026-15176 and CVE-2026-93479 are serious bugs that can be exploited without authentication through a crafted HTTP request.
Under certain conditions beyond their control, an unauthenticated attacker can exploit a security hole to trigger a buffer overflow that leads to a restart. If ASLR is disabled or bypassed, an attacker can reach RCE.
Another critical issue, CVE-2026-97205, can cause memory corruption or worker process termination, or may lead to RCE if ASLR is disabled.
The remaining vulnerabilities could allow an attacker to bypass authentication/validation, read sensitive data, forge request attributes, inject information in proxy requests, cause infinite memory expansion, or access protected paths before authentication.
This week, Juniper Networks Published 17 Guidelines detailing more than 150 security flaws in Junos OS and Junos OS Evolved, and four bugs in the Juniper Cloud-Native Router (JCNR).
About two dozen of these bugs are serious problems that lead to the execution of code / commands with root rights, complete device takeover, kernel surprises, crashes, restarting the machine, interrupting services, and buffer overflow (caused by repeated errors).
The company also patched several high-severity security holes that could lead to RCE, denial of service (DoS), and other types of attacks.
F5 and Juniper Networks do not mention these vulnerabilities being exploited in the wild.
Related: Microsoft fixed two RCE bugs in Office
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Related: Cisco Warns of Exploited Secure Email Vulnerability
Related: Chrome, Firefox Updates Patch 114 Bugs While Mozilla Unveils Firefox Enterprise
