Back to advisories
HIGH CERTFR-2026-AVI-1341

Multiple vulnerabilities in F5 products

Published 19/10/2026 Source : CERT-FR

Description

Multiple vulnerabilities have been discovered in F5 products. Some of them allow an attacker to achieve remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

Impacts

  • Remote denial of service
  • Remote arbitrary code execution
  • Security policy bypass
  • Breach of data confidentiality

Solutions

Refer to the vendor's security bulletin to obtain the patches (see the Documentation section).

Affected Products (10)

F5 DoS for NGINX
Affected versions : F5 DoS for NGINX versions 4.x antérieures à 4.11.0
F5 WAF for NGINX
Affected versions : F5 WAF for NGINX versions 5.x antérieures à 5.14.2 et 5.16.0
F5 · NGINX App Protect DoS
Affected versions : NGINX App Protect DoS versions 4.x
F5 · NGINX App Protect WAF
Affected versions : NGINX App Protect WAF versions 4.x
NGINX App Protect WAF versions 5.x
NGINX Gateway Fabric
Affected versions : NGINX Gateway Fabric versions antérieures à 2.8.0
NGINX Ingress Controller
Affected versions : NGINX Ingress Controller versions antérieures à 5.7.0
NGINX Ingress Controller versions 2026-lts-r3 - 2026-lts-r8
NGINX Instance Manager
Affected versions : NGINX Instance Manager versions 2.x antérieures à 2.24.0
NGINX JavaScript (njs)
Affected versions : NGINX Javascript antérieures à 1.0.2
Nginx Open Source
Affected versions : NGINX Open Source versions 1.31.x antérieures à 1.31.7
NGINX Open Source versions antérieures à 1.30.6
NGINX Plus
Affected versions : NGINX Plus versions antérieures à 37.1.0.1 et 37.0.5.1

Vulnerabilities (CVE) (11)

CVE-2026-101019 CVE-2026-101025 CVE-2026-104939 CVE-2026-15176 CVE-2026-91184 CVE-2026-93479 CVE-2026-94197 CVE-2026-95101 CVE-2026-96615 CVE-2026-97205 CVE-2026-97629

Information

Severity
HIGH
Risk Indicators
? Exploit in Wild ? PoC Public ✗ CISA KEV ✓ Patch Available ? Workaround
Source
CERT-FR CERTFR-2026-AVI-1341
External Link
View Source ↗
Published
19/10/2026
Officially Updated
19/10/2026
Added to OpenVOC
19/10/2026 18:00
Last updated
19/10/2026 19:01
Sign in to see whether your assets are affected and to receive group notifications.