F5 Products Vulnerable to Multiple Security Flaws

On September 3, 2026, Hong Kong GovCERT issued an alert regarding multiple vulnerabilities affecting F5 products, including BIG-IP, BIG-IQ, F5OS, and NGINX. The vulnerabilities could lead to severe consequences such as remote code execution, privilege escalation, and denial of service. Specific affected versions include BIG-IP versions prior to 17.1.3.4, BIG-IQ versions prior to 8.4.2.1, and various NGINX components. System administrators are urged to apply available software updates and mitigations immediately. The vulnerabilities are categorized into multiple flaws rather than a single issue, necessitating careful assessment of each installed product. The Canadian Cyber Centre provided a product and fixed-version matrix to assist organizations in identifying affected components. The advisories emphasize that exposure and remediation depend on the specific configurations and components in use.

Key Points: • Multiple F5 products, including BIG-IP and NGINX, are affected by critical vulnerabilities. • Exploitation could lead to remote code execution and denial of service. • System administrators must apply updates immediately to mitigate risks.