Full Report
F5 security advisory (AV26-878)
Analysis Summary
# Vulnerability: F5 Out-of-band Security Updates (September 2026)
## CVE Details
*Note: The source article (AV26-878) refers to a collective out-of-band update. Specific CVE assignments for this batch are documented in F5's internal advisory K000162872.*
- **CVE ID:** Multiple (Refer to K000162872)
- **CVSS Score:** Pending/High (Based on out-of-band nature)
- **CWE:** Not specified in the brief; likely involves Memory Corruption (NGINX JavaScript) and Unauthorized Access (BIG-IP).
## Affected Systems
- **Products:** BIG-IP (All modules), BIG-IQ, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript, APM Clients.
- **Versions:**
- **BIG-IP:** Versions prior to 17.1.3.4, 17.5.1.8, 21.0.0.3, and 21.1.0.1.
- **BIG-IQ:** Versions prior to 8.4.2.1.
- **NGINX Gateway Fabric:** Versions prior to 2.6.8.
- **NGINX Ingress Controller:** Versions prior to 2026-lts-r5 and 5.6.0.
- **NGINX JavaScript:** Version 9.9 and versions prior to 1.0.1.
- **APM Clients:** Versions prior to 7.2.6.
- **Configurations:** All standard deployments of the affected versions; BIG-IP APM requires specific attention due to multiple version exposure.
## Vulnerability Description
While specific technical details vary by component, this out-of-band release addresses critical flaws across the F5 ecosystem. The inclusion of **NGINX JavaScript** and **BIG-IP APM** suggests potential vulnerabilities related to script execution environments and authentication/session management. These flaws could potentially allow for unauthorized access or system instability.
## Exploitation
- **Status:** Not explicitly stated as "in the wild," but the out-of-band nature suggests a high risk of exploitation or discovered PoCs.
- **Complexity:** Medium to High.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential data exposure in APM/BIG-IP).
- **Integrity:** High (Potential for unauthorized configuration changes).
- **Availability:** High (Potential for Denial of Service in NGINX components).
## Remediation
### Patches
F5 recommends upgrading to the following versions immediately:
- **BIG-IP:** 17.1.3.4, 17.5.1.8, 21.0.0.3, or 21.1.0.1.
- **BIG-IQ:** 8.4.2.1.
- **NGINX Gateway Fabric:** 2.6.8.
- **NGINX Ingress Controller:** 2026-lts-r5 or 5.6.0.
- **NGINX JavaScript:** 1.0.1.
- **APM Clients:** 7.2.6.
### Workarounds
- **Management Port Isolation:** Restrict access to the BIG-IP/BIG-IQ management interface to trusted internal networks only.
- **Module Deactivation:** If NGINX JavaScript (njs) is not required for production traffic, consider disabling the module.
## Detection
- **Indicators of Compromise:** Monitor for unusual administrative logins or unexpected modifications to BIG-IP configuration files (`bigip.conf`).
- **Detection methods and tools:** Utilize F5 BIG-IP iHealth for automated vulnerability scanning and version verification. Monitor NGINX error logs for unusual segmentation faults or worker process crashes.
## References
- F5 Security Advisory K000162872: hxxps[://]my[.]f5[.]com/manage/s/article/K000162872
- Canadian Centre for Cyber Security Alert AV26-878: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/f5-security-advisory-av26-878