17
CVEs
2
Critical
12
High
0
KEV
1
PoC
2
Unpatched C/H
88.2%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
12
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (30)
Big Ip Access Policy Manager
532
Big Ip Application Security Manager
480
Big Ip Advanced Firewall Manager
459
Big Ip Local Traffic Manager
453
Big Ip Policy Enforcement Manager
444
Big Ip Link Controller
437
Big Ip Application Acceleration Manager
436
Big Ip Analytics
426
Big Ip Global Traffic Manager
406
Big Ip Domain Name System
385
Big Ip Fraud Protection Service
326
Big Ip Webaccelerator
229
Big Ip Edge Gateway
225
Big Ip Advanced Web Application Firewall
124
Big Ip Websafe
113
Big Ip Ddos Hybrid Defender
102
Big Ip Ssl Orchestrator
81
Big Iq Centralized Management
68
Big Ip Protocol Security Module
54
Big Ip Carrier Grade Nat
52
Big Ip Application Visibility And Reporting
51
Big Ip
48
Debian Linux
40
Ubuntu Linux
36
Njs
34
Big Ip Wan Optimization Manager
34
Enterprise Manager
33
Big Ip Container Ingress Services
30
Big Ip Automation Toolchain
29
Ssl Orchestrator
27
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-42533 | Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.2 | 0.8% | 47 |
PoC
|
| CVE-2026-78689 | Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis. | CRITICAL | 9.2 | 0.4% | 46 |
|
| CVE-2026-60005 | Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_http_slice_module is compiled in and configured alongside unnamed regex captures, or when a background cache update occurs, letting remote attackers trigger uninitialized memory access (CWE-908) in the data plane. The CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with no user interaction, scored 8.8. There is no public exploit identified at time of analysis and no CISA KEV listing; F5 has released a patch and the issue does not affect the control plane. | HIGH | 8.8 | 0.6% | 45 |
|
| CVE-2026-18329 | NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-59762 | Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 8.7 (High). | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-78222 | NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-55723 | Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-66842 | Privilege escalation in F5 BIG-IP and BIG-IQ allows any authenticated user - regardless of assigned role - to create administrative accounts on the device by sending an undisclosed request to the Traffic Management User Interface (TMUI). The flaw is a control-plane-only issue (no data-plane exposure) but grants a low-privileged attacker full administrative authority over the BIG-IP management plane, including traffic policy, certificate management, and device configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and broad affected version scope make this a high-priority patching target for any organization running BIG-IP. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-77180 | Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-50107 | Configuration injection in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with permission to create or modify NginxProxy Custom Resource Definitions to inject arbitrary NGINX directives into generated configuration files via the unsanitized access log format setting. The flaw resides in the control plane configuration generator and affects deployments using NGINX Plus or NGINX Open Source as the data plane. There is no public exploit identified at time of analysis, and CVSS 4.0 rates the impact at 8.6 (High) driven by high confidentiality and integrity loss on the vulnerable system. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-66362 | Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-56434 | Heap buffer over-read in the ngx_http_ssi_module of NGINX Open Source and NGINX Plus lets an unauthenticated man-in-the-middle attacker who can control upstream responses corrupt worker-process memory or crash the worker, but only in the non-default configuration combining Server-Side Includes, proxy_pass, and proxy_buffering off. The impact is confined to the data plane with no control-plane exposure, yielding limited memory modification and worker restarts (denial of service) rather than full code execution. No public exploit identified at time of analysis, though a vendor patch is available and the flaw carries a CVSS 4.0 score of 8.3. | HIGH | 8.3 | 0.4% | 42 |
|
| CVE-2026-32682 | Denial-of-service in F5 NGINX Gateway Fabric allows an authenticated Kubernetes user with rights to create or modify GRPCRoute resources to crash the control plane by submitting GRPCRoute objects containing malformed backendRef filters. The flaw, tracked under CWE-129 (Improper Validation of Array Index), carries a CVSS 4.0 score of 7.1 with pure availability impact and no public exploit identified at time of analysis. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-52865 | Denial of service in F5 NGINX Ingress Controller allows an authenticated remote attacker holding write access to Ingress or TransportServer resources to crash the control plane by submitting a malformed resource. Because the offending resource persists in the cluster, the controller re-reads it and re-crashes, producing a durable crash loop rather than a one-time outage. There is no public exploit identified at time of analysis, and impact is confined to the control plane with no data plane or confidentiality/integrity exposure. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-60065 | Heap buffer over-read in NGINX Plus's MQTT filter module (ngx_stream_mqtt_filter_module) allows unauthenticated remote attackers to crash the NGINX worker process, causing a brief, recoverable service disruption. The vulnerability is data-plane only - no control plane exposure exists - and exploitation depends partly on runtime conditions outside the attacker's control, reflected by the CVSS 4.0 AT:P metric. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; F5 has released a patch documented in advisory K000162101. | MEDIUM | 6.3 | 0.3% | 32 |
|