F5 Fixes Serious Security Flaws in NGINX and BIG-IP
Patches are now available for multiple vulnerabilities in two widely used networking products that could have let attackers take control of systems, crash services, or steal data.
Key points
- F5, a major American networking company, released patches in 2025 covering multiple security flaws across two of its flagship products.
- The affected software, NGINX and BIG-IP, is used by thousands of businesses worldwide to manage and secure web traffic.
- Attackers who exploited the flaws could have restarted or shut down services, crossed internal security boundaries, exposed data held in memory, or run malicious code on the affected machine.
- F5 hasn't reported any confirmed attacks using these vulnerabilities in the wild.
F5 makes software that sits between the internet and a company's internal systems. Its two best-known products are BIG-IP, a full application delivery and security platform used by banks and government agencies, and NGINX, a lightweight web server that quietly powers a huge slice of the internet.
Both products received patches this week after researchers identified a collection of security vulnerabilities, meaning flaws in software code that attackers can exploit to cause harm.
The damage those flaws could enable is wide in range. Some would let an attacker modify configurations, quietly rewriting the rules governing how traffic flows. Others could crash or restart running processes, the individual programs a server keeps active to do its work. A few cross what security engineers call security boundaries, the internal walls meant to stop one part of a system from affecting another. Two further categories could leak memory, exposing raw data the software holds temporarily, or allow full remote code execution, where an attacker runs whatever software they choose on the victim's machine.
Remote code execution is the most serious outcome on that list. It's essentially the difference between a burglar rattling your letterbox and one who's walked in and changed the locks.
F5 hasn't published individual CVE identifiers, the standardised reference numbers used to track specific vulnerabilities, in the summary reported by SecurityWeek, so independent verification of severity scores isn't yet possible. Organisations running either product should consult F5's official security advisory portal directly for version-specific guidance. We first covered NGINX security issues on 3 June 2026, and our NGINX reporting has noted the pressure AI-assisted discovery is placing on patching cycles.
Should customers be worried?
If your organisation runs BIG-IP or NGINX and hasn't yet applied this week's patches, some concern is warranted. Both products sit at the edge of corporate networks, exactly where attackers look first. A flaw in either is a flaw at the front door.
For ordinary people whose data passes through services built on these products, the practical risk depends entirely on whether the companies running those services patch promptly. There's no direct action end users can take here. The responsibility sits with IT and security teams.
If you work in IT, the immediate step is straightforward: check your installed versions against F5's current advisory and schedule patching. Delaying is the actual risk.
