Threat reportVulnerabilityTL-2026-3723

F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) and Juniper Junos OS / Junos OS Evolved / JCNR Critical Vulnerabilities Patched

criticalPATCHED

F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) (TL-2026-3723) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-16. It has no confirmed attribution, affects F5 NGINX Open Source, references 12 CVEs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205), maps to 3 MITRE ATT&CK techniques (T1059.008, T1190, T1499.004), and is covered by 9 detection rules and 9 indicators of compromise.

CVSS
9.8/10Critical
CVEs
12Referenced vulnerabilities
Techniques
3MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
9Indicators of compromise

Key facts for TL-2026-3723

Threat ID
TL-2026-3723
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
telecoms, technology, government administration, finance, cloud-service-providers, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
9

Malware and tooling in F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

Malware and tooling: NGINX Open Source, NGINX Plus

How F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) works

On 2026-10-14 F5 patched three NGINX memory-corruption flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that an unauthenticated remote attacker can use to crash worker processes, with code execution possible if ASLR is disabled or bypassed. Juniper the same day published 17 advisories covering 150+ defects in Junos OS, Junos OS Evolved and JCNR, about two dozen of them critical (root code/command execution, device takeover). No in-the-wild exploitation or public PoC is reported by either vendor.

F5 NGINX: three advisories published 2026-10-14 affect NGINX Open Source (1.31.0-1.31.6, 1.30.0-1.30.5; CVE-2026-15176 also lists legacy 0.1.29-1.30.x) and NGINX Plus (R33-R36, 37.0.0-37.0.4, 37.1.0). Fixed in NGINX Open Source 1.31.7 and 1.30.6, NGINX Plus 37.1.0.1 and 37.0.5.1. Each carries CVSS v3.1 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2. Exploitation requires crafted HTTP requests against specific configurations, and code execution requires ASLR to be disabled or bypassed; otherwise the result is a worker restart (DoS).

CVE-2026-15176 (K000162416, CWE-122, ngx_http_core_module): heap buffer overflow when a location block combines the alias directive with rewrite and a set or return directive referencing $request_filename. Mitigation: avoid alias in such locations or remove $request_filename references.

CVE-2026-93479 (K000162607, CWE-122): heap buffer overflow involving map directive regex matching, triggered when regex capture variables are referenced before the map output variable in the root directive or access log format (or non-cacheable variables in string expressions). Mitigation: use named captures restricted to the regex match block instead of unnamed captures.

CVE-2026-97205 (K000162608, CWE-416, ngx_http_core_module): use-after-free when asynchronous file I/O (aio) is enabled and a Server Side Includes page containing 'include virtual' is processed. Mitigation: set 'aio off;' or 'ssi off;'. SecurityWeek reports 11 NGINX defects in total in the F5 release; the remaining eight (verification bypass, information disclosure, request attribute spoofing, proxied request data injection, unbounded memory growth, protected path access before authentication) are not itemised in the sources reviewed.

Juniper: 17 advisories published 2026-10-14 covering 150+ defects in Junos OS, Junos OS Evolved and 4 in Juniper Cloud-Native Router (JCNR). About 24 are critical, leading to code/command execution as root, complete device takeover, kernel panic, Routing Engine reboot and service disruption (including an off-by-one buffer overflow). Secondary reporting lists CVSS 9.8 items including CVE-2026-102182 (MX certificate-based IKE RCE), CVE-2026-101954 and CVE-2026-101986 (J-Web unauthenticated access / pre-auth privileged CGI execution), CVE-2026-101956 (J-Web unauthenticated root Junos command execution), CVE-2026-102175 (service-deployment RCE), CVE-2026-33796 (BMP route monitoring RCE), CVE-2026-33792 (SRX GRE tunnel RCE/DoS), CVE-2026-101950 (SRX malformed IPv4 DoS) and CVE-2026-102031 (Evolved TACACS+ privilege escalation). Bulletins cited include JSA112187, JSA112188, JSA112196, JSA112186 and JSA112250. Secondary sources are not fully consistent on which J-Web CVE ids are critical, and primary Juniper JSA pages were not retrieved; verify against the Juniper support portal. Juniper states flaws were found in internal testing and reports no known malicious exploitation; Beazley Security noted no known public PoC. The cvss_score/vector recorded here (9.8) reflects the highest Juniper score reported; the NGINX flaws are 8.1 (v3.1) / 9.2 (v4.0).

No threat actor, IOCs or in-the-wild exploitation are reported. Because both NGINX and Junos are internet-facing infrastructure, rapid patching and exposure reduction (disable J-Web or restrict to trusted admin networks) is advised.

MITRE ATT&CK techniques used in TL-2026-3723

Execution

T1059.008 Command and Scripting Interpreter: Network Device CLI

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Affected products and versions in F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

  • F5 — NGINX Open Source
    Vulnerable versions: 1.31.0-1.31.6; 1.30.0-1.30.5
    Fixed in: 1.31.7; 1.30.6
  • F5 — NGINX Plus
    Vulnerable versions: R33; R34; R35; R36; 37.0.0-37.0.4; 37.1.0
    Fixed in: 37.0.5.1; 37.1.0.1
  • Juniper Networks — Junos OS
    Vulnerable versions: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; later branches through 26.2R1-S2
    Fixed in: see per-JSA version matrices
  • Juniper Networks — Junos OS Evolved
    Vulnerable versions: before 23.2R2-S7.7-EVO through 26.2R1-S2-EVO
    Fixed in: see per-JSA version matrices
  • Juniper Networks — Juniper Cloud-Native Router (JCNR)
    Vulnerable versions: 4 vulnerabilities, versions not itemised in sources
    Fixed in: see Juniper advisories

Remediation for F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

Patches

  • F5 K000162416 (CVE-2026-15176)
  • F5 K000162607 (CVE-2026-93479)
  • F5 K000162608 (CVE-2026-97205)
  • Juniper JSA112186, JSA112187, JSA112188, JSA112196, JSA112250

Immediate actions

  • Upgrade NGINX Open Source to 1.31.7 or 1.30.6 and NGINX Plus to 37.1.0.1 or 37.0.5.1
  • Apply Juniper fixed releases or rebuilt software respins per each JSA version matrix
  • Disable J-Web or restrict it to trusted administrative networks until patched
  • Do not run NGINX hosts with ASLR disabled (kernel.randomize_va_space=2)

Workarounds

  • CVE-2026-15176: avoid alias in affected location blocks or remove $request_filename references
  • CVE-2026-93479: use named regex captures restricted to the regex match block
  • CVE-2026-97205: set 'aio off;' or 'ssi off;'
  • Juniper: no known workarounds for many of the critical issues; J-Web access restriction reduces exposure

Longer-term hardening

  • Keep management interfaces (J-Web, SSH, NETCONF) off the internet and behind a management VRF/ACL
  • Inventory NGINX configurations using alias+rewrite with $request_filename, map with regex captures, and aio+ssi
  • Monitor for repeated NGINX worker process crashes and Junos daemon/Routing Engine restarts

CVEs associated with F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-102182, CVE-2026-101954, CVE-2026-101956, CVE-2026-101986, CVE-2026-102175, CVE-2026-33796, CVE-2026-33792, CVE-2026-101950, CVE-2026-102031

Weaknesses (CWE) in F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

CWE-122, CWE-416

Timeline of F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

  • Juniper's previous quarterly-style bundle (27 advisories across Junos OS, Evolved, Space, cRPD) published; no known exploitation, context for the October release
  • Juniper publishes 17 advisories covering 150+ defects in Junos OS, Junos OS Evolved and 4 in JCNR, about 24 critical
  • NVD records for the three NGINX CVEs published (CVSS v3.1 8.1, v4.0 9.2)
  • F5 publishes advisories K000162416, K000162607 and K000162608 for CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205 with fixes in NGINX 1.31.7/1.30.6 and NGINX Plus 37.1.0.1/37.0.5.1
  • Secondary reporting details Juniper CVSS 9.8 flaws including J-Web unauthenticated root command execution and recommends disabling or restricting J-Web
  • SecurityWeek reports both vendors' patches; neither vendor reports exploitation in the wild

Sources cited for F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)

Detection coverage for TL-2026-3723

As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3723 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
9 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats