F5 Releases Critical Security Patches for BIG-IP, NGINX, and More

Vulnerabilities could enable remote denial-of-service attacks, prompting urgent updates

Apr. 12, 2026 at 11:04am

Got story updates? Submit your updates here. ›

A highly detailed, 3D macro illustration of a glowing network switch or router device with illuminated ports and cables, representing the critical infrastructure vulnerabilities in F5's enterprise networking products that could lead to denial-of-service attacks on high-traffic environments.Glowing cybersecurity vulnerabilities in F5's enterprise networking products expose high-traffic environments to potential denial-of-service attacks.San Jose Today

F5 has released its Quarterly Security Notification for February 2026, highlighting several medium and low-severity vulnerabilities across its BIG-IP, NGINX, and container services offerings. The most critical issues could enable remote denial-of-service (DoS) attacks, potentially disrupting high-traffic environments like web application firewalls and Kubernetes ingress setups. While no active exploits have been reported, F5 is urging customers to promptly apply the available patches to internet-facing deployments.

Why it matters

These vulnerabilities present moderate DoS threats, with CVSS scores reaching up to 8.2 on version 4.0, meaning attackers could potentially overwhelm services from a remote location. The widespread impact across the NGINX ecosystem and F5's containerized services underscores the importance of addressing these flaws to maintain the availability and security of critical infrastructure.

The details

The vulnerabilities primarily involve risks associated with denial-of-service (DoS) attacks and weaknesses in system configurations. These issues could potentially disrupt environments that experience high traffic, such as web application firewalls (WAF) and Kubernetes ingress setups. F5 provides comprehensive CVSS scores, both v3.1 and v4.0, for first-party issues, emphasizing critical aspects such as the attack vector, required privileges, and overall impact.

  • On February 4, 2026, F5 released its Quarterly Security Notification for February.

The players

F5

An American company that specializes in application services and application delivery networking.

BIG-IP

F5's flagship product, a family of application delivery controllers and network traffic management devices.

NGINX

An open-source web server software for serving content and balancing loads.

Got photos? Submit your photos here. ›

What’s next

Organizations utilizing NGINX-heavy setups should prioritize addressing medium CVEs. It is crucial to scan for affected versions (only those before EoTS), apply necessary fixes using iHealth or Helm for CIS, and conduct tests in staging environments to prevent operational disruptions.

The takeaway

These identified flaws present moderate DoS threats, underscoring the importance for organizations to promptly apply the available patches from F5 to protect their internet-facing deployments and critical infrastructure from potential disruption or unauthorized access.