F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
On October 15, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1049 covering vulnerabilities F5 disclosed on October 14 in NGINX and related products. Affected lines include NGINX Gateway Fabric before 2.8.0, Ingress Controller before 5.7.0, NGINX Open Source before 1.30.6 and 1.31.7, NGINX Plus, Instance Manager, and F5 WAF and DoS for NGINX. The notice cites CVE-2026-101019, CVE-2026-104939, and CVE-2026-15176 and urges administrators to apply available updates. No exploitation is described.
- Canadian Cyber Centre advisory AV26-1049 covers multiple NGINX and F5 products.
- Cited flaws are CVE-2026-101019, CVE-2026-104939, and CVE-2026-15176.
- Fixed versions are listed; exploitation is not reported.
- Administrators are told to review F5 articles and patch.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101019 | njs XML entity attributes bypass nginx-saml checks | 8.3 | — | ||
| CVE-2026-104939 | Auth bypass in F5 NGINX Ingress Controller externalAuth | 8.7 | — | ||
| CVE-2026-15176 | NGINX heap overflow via alias and $request_filename | 9.2 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1049 Date: October 15, 2026 As of October 14, 2026, F5 is affected by vulnerabilities in the following products: NGINX Gateway Fabric Prior to 2. 8. 0 NGINX Ingress Controller Prior to 5.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.