F5

F5 releases out-of-band patches for CVE-2026-42530 and CVE-2026-42055, both CVSS 9.2 vulnerabilities in NGINX Open Source that allow unauthenticated remote code execution.

CISA added CVE-2025-53521 to its KEV catalog after F5 reclassified the BIG-IP APM vulnerability from DoS to remote code execution. CVSS 9.8—federal deadline is March 30.