7
CVEs
1
Critical
5
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
5
MEDIUM
0
LOW
1
Monthly CVE Trend
Affected Products (30)
Big Ip Access Policy Manager
532
Big Ip Application Security Manager
480
Big Ip Advanced Firewall Manager
459
Big Ip Local Traffic Manager
453
Big Ip Policy Enforcement Manager
444
Big Ip Link Controller
437
Big Ip Application Acceleration Manager
436
Big Ip Analytics
426
Big Ip Global Traffic Manager
406
Big Ip Domain Name System
385
Big Ip Fraud Protection Service
326
Big Ip Webaccelerator
229
Big Ip Edge Gateway
225
Big Ip Advanced Web Application Firewall
124
Big Ip Websafe
113
Big Ip Ddos Hybrid Defender
102
Big Ip Ssl Orchestrator
81
Big Iq Centralized Management
68
Big Ip Protocol Security Module
54
Big Ip Carrier Grade Nat
52
Big Ip Application Visibility And Reporting
51
Big Ip
48
Debian Linux
40
Ubuntu Linux
36
Njs
34
Big Ip Wan Optimization Manager
34
Enterprise Manager
33
Big Ip Container Ingress Services
30
Big Ip Automation Toolchain
29
Ssl Orchestrator
27
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78689 | Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis. | CRITICAL | 9.2 | 0.4% | 46 |
|
| CVE-2026-18329 | NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-78222 | NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-66842 | Privilege escalation in F5 BIG-IP and BIG-IQ allows any authenticated user - regardless of assigned role - to create administrative accounts on the device by sending an undisclosed request to the Traffic Management User Interface (TMUI). The flaw is a control-plane-only issue (no data-plane exposure) but grants a low-privileged attacker full administrative authority over the BIG-IP management plane, including traffic policy, certificate management, and device configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and broad affected version scope make this a high-priority patching target for any organization running BIG-IP. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-77180 | Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-66362 | Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-63020 | Error message spoofing in F5 BIG-IP's Configuration utility (TMUI) allows a remote, unauthenticated attacker to reflect fabricated error messages inside an authenticated administrator's browser session by tricking them into clicking a crafted link. The flaw is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is strictly a control-plane issue - the data plane handling live traffic is unaffected. F5 has assigned a CVSS 4.0 score of 2.3, reflecting the combination of high attack complexity, mandatory user interaction, and the narrow integrity-only impact of spoofed UI content. | LOW | 2.3 | 0.2% | 12 |
|