F5 Security Advisory Av26 878

Back www.cyber.gc.ca

F5 Security Advisory Av26 878

www.cyber.gc.ca • September 6, 2026

Share: View original

As of September 2, 2026, F5 is affected by vulnerabilities in the following products:

BIG-IP (all modules) Prior to 17.1.3.4 Prior to 17.5.1.8 Prior to 21.0.0.3 Prior to 21.1.0.1

BIG-IQ Prior to 8.4.2.1

NGINX Gateway Fabric Prior to 2.6.8

NGINX Ingress Controller Prior to 2026-lts-r5 Prior to 5.6.0

NGINX JavaScript 9.9 Prior to 1.0.1

APM Clients Prior to 7.2.6

BIG-IP APM Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

K000162872: Out-of-band Security Notification (September 2, 2026)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

F5 Products Vulnerable to Multiple Security Flaws On September 3, 2026, Hong Kong GovCERT issued an alert regarding multiple vulnerabilities affecting F5 products, including BIG-IP, BIG-IQ, F5OS, and NGINX. The vulnerabilities could lead to severe consequences such as remote code execution, privilege escalation, and denial of service. Specific affected versions include BIG-IP versions prior to 17.1.3.4, BIG-IQ versions prior to 8.4.2.1, and various NGINX components. System administrators are urged to apply available software updates and mitigations immediately. The vulnerabilities are categorized into multiple flaws rather than a single issue, necessitating careful assessment of each installed product. The Canadian Cyber Centre provided a product and fixed-version matrix to assist organizations in identifying affected components. The advisories emphasize that exposure and remediation depend on the specific configurations and components in use. 3 sources 61

Extracted Entities

Platforms (6)

APM Clients Big-ip Big-iq Nginx Gateway Fabric Nginx Ingress Controller Nginx JavaScript