Loading story…
F5 issued an out-of-band security notification, K000162872, addressing vulnerabilities affecting BIG-IP, BIG-IQ, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript, APM Clients, and BIG-IP APM. The Canadian Centre for Cyber Security and Guyana National CIRT published advisories urging organizations to review the notification and deploy the applicable vendor remediations.
Affected BIG-IP installations include systems running releases earlier than 17.1.3.4, 17.5.1.8, 21.0.0.3, or 21.1.0.1; affected NGINX Ingress Controller versions are earlier than 2026-lts-r5 and 5.6.0. Administrators should identify exposed F5 deployments, validate installed modules and versions, and prioritize upgrades to the specified fixed releases when available.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-878 describing the affected F5 products and advising users and administrators to review F5 notification K000162872 and apply necessary updates.
F5 published security advisory SOL000162417 for BIG-IP Access Policy Manager, with a corresponding patch released on the same date. Tenable's local-check plugin reported no known exploits but did not provide a CVE identifier or fixed-version details.
CVE-2026-78689 was published as an unpatched vulnerability affecting Debian 12.0, 13.0, and 14.0 installations of libnginx-mod-js. Tenable reported network reachability, no required privileges or user interaction, high confidentiality, integrity, and availability impacts, and no known exploits at publication.
CVE-2026-18329 was published affecting Debian Linux 12.0, 13.0, and 14.0, including the libnginx-mod-js package. Tenable classified it as unpatched, network-reachable, and low complexity with no known exploits available.
F5 published CVE-2026-66842, a CVSS 8.8 network-accessible vulnerability affecting BIG-IP and multiple modules, including APM, AFM, ASM, DNS, LTM, and SSL Orchestrator. Patch information was published the same day; the referenced Nessus plugin reported no known public exploits at the time.
F5 issued out-of-band security notification K000162872 addressing vulnerabilities affecting BIG-IP, BIG-IQ, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript, APM Clients, and BIG-IP APM. The notification identified affected releases and directed customers to apply applicable fixed updates.
CVE-2026-13204 was published affecting F5 BIG-IP DNS and Global Traffic Manager components, including BIG-IP hardware. The remotely reachable, low-complexity vulnerability has a CVSS v3.0 score of 7.5 and high availability impact; no known exploits were available.
SophosLabs analyzed a Linux second-stage implant, also called PoisonedRefresh by ESET and detected as Linux/Agnt-IC, associated with F5 BIG-IP APM systems compromised through CVE-2025-53521. The implant injects an in-memory PHP web shell into APM webtop files and establishes an authenticated UNIX-domain-socket backdoor at /run/bigtlog.pipe; Sophos found insufficient evidence to attribute the activity to a specific threat actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcetenable.com
Open sourcecirt.gy
Open sourcetenable.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 has disclosed multiple vulnerabilities affecting **NGINX** product lines, including **NGINX Open Source**, **NGINX Plus**, **NGINX Gateway Fabric**, and **NGINX Ingress Controller**, with the most serious issue tracked as **`CVE-2026-42533`**. The flaw can lead to **remote code execution**, while additional reported weaknesses include **information disclosure** and **security restriction bypass** across several version ranges. National cybersecurity authorities in Europe have highlighted the breadth of affected products and the severity of the exposure. F5 released fixes on **2026-07-15** and urged customers to update immediately, warning that the vulnerable configuration is considered typical even if not every deployment is affected. Authorities also noted that **proof-of-concept exploit code** is already public, raising the likelihood of opportunistic attacks despite no confirmed large-scale exploitation so far. Where immediate patching is not possible, temporary mitigations are available, but vendor-recommended upgrades to fixed versions remain the primary remediation step.
Jul 30, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026
F5 released patches for two critical remote code execution vulnerabilities in **NGINX Open Source** and **NGINX Plus**: `CVE-2026-42530`, a use-after-free flaw in the HTTP/3 QUIC module, and `CVE-2026-42055`, a heap-based buffer overflow in HTTP/2 proxy modules. Both issues carry a **CVSS 9.2** rating and can be exploited remotely without authentication under specific configurations, potentially affecting a broad set of F5 NGINX products including **NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager, and App Protect WAF**. F5 said the flaws were fixed in **NGINX Open Source 1.31.2 and 1.30.3** and published mitigations for organizations that cannot patch immediately, including disabling HTTP/3, restoring `ignore_invalid_headers` to its default behavior, and reducing `large_client_header_buffers` sizes. A related Apache HTTP Server security update was also issued by EG-FinCIRT, underscoring continued patching activity around widely deployed web server infrastructure, although no active exploitation of the NGINX flaws had been confirmed at the time of reporting.
Jul 7, 2026