# F5 NGINX (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) and Juniper Junos OS / Junos OS Evolved / JCNR Critical Vulnerabilities Patched

> On 2026-10-14 F5 patched three NGINX memory-corruption flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that an unauthenticated remote attacker can use to crash worker processes, with code execution possible if ASLR is disabled or bypassed. Juniper the same day published 17 advisories covering 150+ defects in Junos OS, Junos OS Evolved and JCNR, about two dozen of them critical (root code/command execution, device takeover). No in-the-wild exploitation or public PoC is reported by either vendor.

- **Published:** 2026-10-16T10:16:02Z
- **Last reviewed:** 2026-10-16T10:16:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3723
- **ID:** TL-2026-3723
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-102182, CVE-2026-101954, CVE-2026-101956, CVE-2026-101986, CVE-2026-102175, CVE-2026-33796, CVE-2026-33792, CVE-2026-101950, CVE-2026-102031

## Description

F5 NGINX: three advisories published 2026-10-14 affect NGINX Open Source (1.31.0-1.31.6, 1.30.0-1.30.5; CVE-2026-15176 also lists legacy 0.1.29-1.30.x) and NGINX Plus (R33-R36, 37.0.0-37.0.4, 37.1.0). Fixed in NGINX Open Source 1.31.7 and 1.30.6, NGINX Plus 37.1.0.1 and 37.0.5.1. Each carries CVSS v3.1 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2. Exploitation requires crafted HTTP requests against specific configurations, and code execution requires ASLR to be disabled or bypassed; otherwise the result is a worker restart (DoS).

CVE-2026-15176 (K000162416, CWE-122, ngx_http_core_module): heap buffer overflow when a location block combines the alias directive with rewrite and a set or return directive referencing $request_filename. Mitigation: avoid alias in such locations or remove $request_filename references.

CVE-2026-93479 (K000162607, CWE-122): heap buffer overflow involving map directive regex matching, triggered when regex capture variables are referenced before the map output variable in the root directive or access log format (or non-cacheable variables in string expressions). Mitigation: use named captures restricted to the regex match block instead of unnamed captures.

CVE-2026-97205 (K000162608, CWE-416, ngx_http_core_module): use-after-free when asynchronous file I/O (aio) is enabled and a Server Side Includes page containing 'include virtual' is processed. Mitigation: set 'aio off;' or 'ssi off;'. SecurityWeek reports 11 NGINX defects in total in the F5 release; the remaining eight (verification bypass, information disclosure, request attribute spoofing, proxied request data injection, unbounded memory growth, protected path access before authentication) are not itemised in the sources reviewed.

Juniper: 17 advisories published 2026-10-14 covering 150+ defects in Junos OS, Junos OS Evolved and 4 in Juniper Cloud-Native Router (JCNR). About 24 are critical, leading to code/command execution as root, complete device takeover, kernel panic, Routing Engine reboot and service disruption (including an off-by-one buffer overflow). Secondary reporting lists CVSS 9.8 items including CVE-2026-102182 (MX certificate-based IKE RCE), CVE-2026-101954 and CVE-2026-101986 (J-Web unauthenticated access / pre-auth privileged CGI execution), CVE-2026-101956 (J-Web unauthenticated root Junos command execution), CVE-2026-102175 (service-deployment RCE), CVE-2026-33796 (BMP route monitoring RCE), CVE-2026-33792 (SRX GRE tunnel RCE/DoS), CVE-2026-101950 (SRX malformed IPv4 DoS) and CVE-2026-102031 (Evolved TACACS+ privilege escalation). Bulletins cited include JSA112187, JSA112188, JSA112196, JSA112186 and JSA112250. Secondary sources are not fully consistent on which J-Web CVE ids are critical, and primary Juniper JSA pages were not retrieved; verify against the Juniper support portal. Juniper states flaws were found in internal testing and reports no known malicious exploitation; Beazley Security noted no known public PoC. The cvss_score/vector recorded here (9.8) reflects the highest Juniper score reported; the NGINX flaws are 8.1 (v3.1) / 9.2 (v4.0).

No threat actor, IOCs or in-the-wild exploitation are reported. Because both NGINX and Junos are internet-facing infrastructure, rapid patching and exposure reduction (disable J-Web or restrict to trusted admin networks) is advised.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1059.008 Command and Scripting Interpreter: Network Device CLI

## Sources

- [SecurityWeek: F5, Juniper Networks Patch Critical Vulnerabilities](https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/)
- [F5 Advisory K000163408](https://my.f5.com/manage/s/article/K000163408)
- [F5 Advisory K000162416 (CVE-2026-15176)](https://my.f5.com/manage/s/article/K000162416)
- [F5 Advisory K000162607 (CVE-2026-93479)](https://my.f5.com/manage/s/article/K000162607)
- [F5 Advisory K000162608 (CVE-2026-97205)](https://my.f5.com/manage/s/article/K000162608)
- [NVD: CVE-2026-97205](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-97205)
- [NVD: CVE-2026-93479](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-93479)
- [NVD: CVE-2026-15176](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-15176)
- [SecurityOnline: F5 Patches Three Critical NGINX Vulnerabilities](https://securityonline.info/f5-patches-three-critical-nginx-vulnerabilities/)
- [SecurityOnline: Juniper Networks Patches Critical Junos OS Vulnerabilities Across Core Platforms](https://securityonline.info/juniper-patches-critical-junos-os-vulnerabilities/)
- [Mallory: Juniper Patches Critical J-Web Authentication Flaws Enabling Root-Level Commands](https://mallory.ai/stories/01a13f85-d4cc-7c7a-87cd-f874d952157f)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3723