F5 and Juniper Disclose 161 Flaws Including 27 Critical RCE Paths in NGINX and Junos

F5 released fixes for 11 NGINX defects on 13 May. CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205 permit crafted HTTP requests to trigger buffer overflows or memory corruption. Exploitation reaches remote code execution only if ASLR is off or bypassed. The remaining eight flaws allow verification bypass, information disclosure and path traversal before authentication. Juniper simultaneously published 17 advisories covering 150 Junos OS and four JCNR defects, two dozen rated critical for root-level code execution via off-by-one errors and kernel panics.

Procurement records show both vendors hold multi-year contracts with US federal agencies and Tier-1 carriers. Public patch notes contain no evidence of in-the-wild exploitation, yet the same pattern preceded the 2024 Palo Alto PAN-OS zero-day and Cisco Secure Email Gateway campaigns where exploitation surfaced within 14 days of disclosure. Contract award databases list F5 BIG-IP and Juniper MX routers as mandatory components in several classified network modernization programs, indicating broad exposure in critical infrastructure.

No independent technical attribution of prior exploitation exists. Official vendor statements emphasize absence of observed attacks, yet the volume of unauthenticated RCE vectors aligns with procurement-driven deployment density rather than random targeting. Operators must inventory exposed instances within 72 hours and apply patches before the next observed campaign window, expected inside 30 days based on historical disclosure-to-exploitation intervals for equivalent CVSS 9.8+ flaws.