Vulnerabilities
Multiple RCE, Data Breach, and DoS Vulnerabilities in F5 NGINX Products
F5 has disclosed multiple critical vulnerabilities affecting its NGINX-based products, including remote code execution, data confidentiality and integrity compromise, and denial‑of‑service. Affected versions span F5 DoS for NGINX 4.x <4.11.0, F5 WAF for NGINX 5.x <5.16.0, and several other NGINX components. Defenders should verify product versions, apply vendor patches, and monitor for anomalous activity.
What happened
F5 announced a set of critical security flaws in its NGINX‑based offerings that allow attackers to execute arbitrary code, exfiltrate or modify data, and launch remote denial‑of‑service attacks.
Impact
These vulnerabilities can compromise the confidentiality, integrity, and availability of systems that rely on the affected F5 components.
Affected Products
- F5 DoS for NGINX 4.x versions <4.11.0
- F5 WAF for NGINX 5.x versions <5.16.0
- NGINX Gateway Fabric 2.x versions <2.8.0
- NGINX Ingress Controller 5.x versions <5.7.0
- NGINX Instance Manager 2.x versions <2.24.0
- NGINX Open Source 1.x versions <1.31.7
- NGINX Plus 37.x versions <37.2.0
Mitigation
Apply the latest vendor patches referenced in the F5 security bulletins (K000162416, K000162606, K000162607, K000162608, K000162613). Verify that your deployment is running a supported version. Monitor logs for anomalous requests and restrict external access to management interfaces.
CVE-2026-15176, CVE-2026-93479, CVE-2026-95101
Related vulnerabilities
Debian Linux Kernel Vulnerabilities: Privilege Escalation, Data Breach, DoS – Immediate Update Required
Multiple kernel CVEs (CVE-2024-52560, CVE-2024-58094, CVE-2024-58095, CVE-2025-21817, CVE-2025-22104, CVE-2025-22108, CVE-2025-22127, CVE-2025-38203, CVE-2025-38205, CVE-2025-38206) affect Debian trixie kernels older than 6.12.111-1, enabling privilege escalation, confidentiality loss, and denial of service. Apply the Debian security bulletin msg00441 updates immediately and verify kernel version.
Read briefing
Ubuntu Kernel Vulnerabilities - Oct 2026
Multiple vulnerabilities have been disclosed affecting the Linux kernel in Ubuntu. These vulnerabilities allow for potential remote code execution, privilege escalation, and denial-of-service conditions. Defenders should prioritize patching systems according to the provided Ubuntu Security Notices.
Read briefing
MISP Hit by Cluster of Critical Vulnerabilities – Remote DoS, Data Breach, Integrity Flaws
French CERT has identified a wave of CVEs affecting all MISP releases older than 2.5.45. The flaws allow attackers to trigger remote denial‑of‑service, exfiltrate sensitive data, corrupt stored information, and exploit SSRF, XSS, and CSRF vectors. Patches are already available; operators must update immediately.
Read briefing
Adobe June 2026 Patch Tuesday: 11 Bulletins, 123 CVEs, CVSS 10.0 in Campaign Classic
Adobe released 11 security bulletins in June 2026, addressing 123 CVEs across multiple products. The highest severity CVSS 10.0 is in Campaign Classic, with other critical CVEs in ColdFusion and Acrobat Reader. Defenders should prioritize patching Campaign Classic first, then ColdFusion and Acrobat Reader, and monitor for exploitation.
Read briefing