Three critical-severity vulnerabilities — CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479 — can allow remote attackers to crash or run code on NGINX systems, F5 warned when it released out-of-band security patches.
Which NGINX components and products are affected
The bugs originate in two places: the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479). F5 said the flaws affect multiple NGINX software products and has published patches for NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.
Technical impact: heap-based buffer overflow, use‑after‑free, and ASLR caveats
According to the advisory, remote attackers with no privileges can exploit these bugs to launch denial-of-service attacks or to gain code execution on systems running non-default configurations. Successful exploitation causes a heap-based buffer overflow or a use-after-free in the NGINX worker process, producing crashes or worker restarts.
F5 also warned that attackers "may also be able to execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR." In short: impact ranges from DoS to potential remote code execution depending on target configuration and the attacker’s ability to defeat mitigations like ASLR.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMitigations, patches, and practical steps for administrators
F5 issued out-of-band security patches for the affected NGINX products and recommended that teams install them as soon as feasible. For organizations that cannot immediately apply patches, F5 documented specific temporary mitigations:
- For CVE-2026-15176: do not use the 'alias' directive in a location block and avoid using the $request_filename variable.
- For CVE-2026-97205: disable asynchronous file I/O (AIO) or disable Server Side Includes (SSI).
- For CVE-2026-93479: use named captures rather than unnamed captures and limit captures to the block containing the regex match.
Those mitigations are configuration workarounds, not full replacements for the vendor patches; F5’s out-of-band releases are the definitive remediation path that administrators should prioritize.
Context: prior F5-targeted activity and recent incidents
F5 has not flagged these new vulnerabilities as exploited in the wild. Still, the advisory placed the flaws against a recent history in which attackers have repeatedly targeted F5 products. The report notes attackers have used F5 security weaknesses to breach corporate networks, map internal servers, hijack devices, deploy data‑wiping malware, and steal sensitive documents.
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tracked eight F5 vulnerabilities as actively exploited; four of those were also abused in ransomware attacks. F5 itself disclosed that state-sponsored threat actors breached its systems in August 2025 and stole source code and information on undisclosed BIG-IP security vulnerabilities, a breach the company revealed in October 2025.
What this means for technologists, procurement leaders, and adversaries
- Technologists and security teams: prioritize patching NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager where they are in use; apply the configuration mitigations if immediate patching is not possible.
- Procurement leaders and affected enterprises: note that F5 serves over 23,000 customers, including 80% of the Fortune Global 500 and 48 Fortune 50 companies, so exposure can be broad across large enterprises — patch windows and vendor response SLAs will be operational priorities.
- Adversaries and threat actors: the advisory underscores an ongoing pattern where both cybercrime and nation-state groups have exploited F5 product flaws in recent years; while these three CVEs are not yet reported as exploited in the wild, historical exploitation activity makes them likely targets for opportunistic attackers.
F5’s out-of-band patches close a set of urgent technical holes, but the advisory underscores two persistent operational realities: configuration choices and defensive posture materially affect exploitability, and high-value infrastructure — here, products with wide enterprise deployment — attracts focused scrutiny from attackers. For operators, the immediate question is binary and concrete: deploy the vendor patches now, or apply the mitigations and schedule a timely upgrade. For defenders watching attack telemetry, the next days will show whether these flaws remain theoretical or become weaponized in active campaigns.
Source: BleepingComputer — F5 releases out-of-band patches for critical NGINX vulnerabilities
