Key points
- Three critical vulnerabilities (CVE-2026-15176, CVE-2026-97205, CVE-2026-93479) allow code execution and DoS attacks.
- Affected products include NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager.
- F5 has released out-of-band patches; no wild exploitation is currently confirmed by the vendor.
F5 has issued out-of-band security updates for NGINX to address three critical vulnerabilities that could enable remote code execution or denial of service. The patches cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager, according to CSO Online.
What happened
F5 disclosed three flaws rated 9.2 on the Common Vulnerability Scoring System version 4.0, classified as critical severity. CVE-2026-15176 and CVE-2026-97205 reside in the ngx_http_core_module and can cause heap buffer overflows in worker processes, per CSO Online. These memory corruption issues may crash systems or allow code execution if Address Space Layout Randomisation is disabled or bypassed.
CVE-2026-93479 involves a map directive flaw where crafted HTTP requests can trigger similar heap buffer overflows. Attackers could execute code on systems with disabled or bypassed ASLR, according to the report. F5 stated these issues could also facilitate denial of service attacks that render servers inaccessible to legitimate users.
Why it matters
NGINX often serves as the primary entry point for web traffic, handling reverse proxying, load balancing, and Kubernetes ingress, according to Frank Dickson of Dickson Research cited in CSO Online. Because transport layer security usually terminates at NGINX, successful code execution exposes sensitive data. Dickson noted this includes passwords, session cookies, API tokens, and private keys in clear text.
F5 confirmed it has not found evidence of these specific flaws being exploited in the wild. However, the vendor advises immediate installation of the fixed versions given the critical rating and potential impact, according to CSO Online. These vulnerabilities follow a June disclosure of CVE-2026-42530 in the ngx_http_v3_module.
What happens next
- Identify all instances of NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager across environments.
- Verify current versions against the fixed releases provided by F5 in the out-of-band update.
- Schedule immediate deployment of patches for internet-facing and high-traffic systems prioritising exposure reduction.
- Monitor logs for signs of exploitation attempts or unusual worker process crashes during the rollout period.
Patch priority
Organisations should prioritise updating systems exposed to untrusted networks first, as these face the highest risk of remote exploitation. Teams usually begin with internet-facing load balancers and reverse proxies before moving to internal ingress controllers. It is advisable to test patches in non-production environments to ensure stability before widespread deployment. Backing up configurations and system states before applying updates helps mitigate operational risks during the remediation process.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: F5
- Audit inventory to locate all NGINX components, including those managed by third-party tools or container orchestration platforms.
- Check vendor advisories for specific version numbers included in the out-of-band patches and compare them with deployed instances.
- Implement strict input validation and rate limiting where possible to reduce the attack surface until patches are fully deployed.
- Review firewall rules to restrict access to management interfaces and limit exposure of NGINX services to trusted networks only.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which NGINX products are affected by these new vulnerabilities?
NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager are impacted.
Is there evidence that these flaws are currently being exploited?
F5 stated it has not discovered evidence of these issues being exploited in the wild, according to CSO Online.
What type of attack can these vulnerabilities facilitate?
The flaws can lead to heap buffer overflows, potentially allowing code execution or denial of service attacks.
