F5 Products Vulnerable to Multiple Security Flaws

• •Multiple F5 products, including BIG-IP and NGINX, are affected by critical vulnerabilities.
• •Exploitation could lead to remote code execution and denial of service.
• •System administrators must apply updates immediately to mitigate risks.

On September 3, 2026, Hong Kong GovCERT issued an alert regarding multiple vulnerabilities affecting F5 products, including BIG-IP, BIG-IQ, F5OS, and NGINX. The vulnerabilities could lead to severe consequences such as remote code execution, privilege escalation, and denial of service. Specific affected versions include BIG-IP versions prior to 17.1.3.4, BIG-IQ versions prior to 8.4.2.1, and various NGINX components. System administrators are urged to apply available software updates and mitigations immediately. The vulnerabilities are categorized into multiple flaws rather than a single issue, necessitating careful assessment of each installed product. The Canadian Cyber Centre provided a product and fixed-version matrix to assist organizations in identifying affected components. The advisories emphasize that exposure and remediation depend on the specific configurations and components in use.