F5 said on October 14, 2026 that it had published new security notices. SecurityWeek reported on October 16 that F5 fixed 11 NGINX flaws, three critical: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205. It said Juniper Networks issued 17 advisories covering over 150 flaws in Junos OS and Junos OS Evolved, plus four in Cloud-Native Router. About two dozen are critical.
F5's page is only an index that points to separate articles. SecurityWeek says the first two NGINX flaws can be hit without logging in, using crafted web requests, under conditions beyond the attacker's control. A buffer overflow is a program writing more data than a space can hold. Here it can force a restart. If ASLR, which randomizes where data sits in memory, is disabled or can be bypassed, an attacker could run code. SecurityWeek says Juniper's critical flaws include root-level command execution, full device takeover and an off-by-one overflow. Neither vendor mentions attacks in the wild. The reports give no fix versions and name no Juniper critical flaws.
In the NGINX flaws, ASLR is what separates a crash from code execution. Leaders can ask where NGINX and Junos run, who owns patching, and whether ASLR is on. Juniper's critical details come only from SecurityWeek's summary.