F5 security advisories, October 2026

Every F5 security advisory published in October 2026, from F5 SIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 11
Critical: 3
High: 6
In CISA KEV: 0
CVEs: 11

F5 advisories published in October 2026

Oct 14, 2026
Critical [CVE-2026-97205] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module
Critical9.2
Oct 14, 2026
Critical [CVE-2026-93479] vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable
Critical9.2
Oct 14, 2026
Critical [CVE-2026-15176] vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable
Critical9.2
Oct 14, 2026
High [CVE-2026-104939] NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress
High8.7
Oct 14, 2026
High [CVE-2026-101019] NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization
High8.3
Oct 14, 2026
High [CVE-2026-94197] authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication
High8.7
Oct 14, 2026
High [CVE-2026-96615] NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent
High7.1
Oct 14, 2026
High [CVE-2026-91184] NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";
High8.7
Oct 14, 2026
High [CVE-2026-97629] When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control
High8.3
Oct 14, 2026
Medium [CVE-2026-101025] NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails
Medium6.9
Oct 14, 2026
Medium [CVE-2026-95101] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module
Medium6.9

Get an email when F5 publishes the next one.

See F5's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about F5

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.