F5 has issued out-of-band security patches for several flaws in its NGINX web server software, including three critical-severity vulnerabilities that could allow attackers to run code on affected systems. The updates cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. The most serious of the bugs affect the ngx_http_v3_module, tracked as CVE-2026-15176 and CVE-2026-97205, and the NGINX map directive, tracked as CVE-2026-93479.
According to F5, unauthenticated remote attackers can exploit these flaws to cause denial-of-service conditions or to achieve code execution, though code execution applies to systems running non-default configurations. Exploitation produces either a heap-based buffer overflow or a use-after-free condition inside the NGINX worker process, which can crash or restart the service. F5 said attackers may also be able to execute code on systems where Address Space Layout Randomization is disabled, or where they can otherwise bypass ASLR.
For organizations that cannot apply the patches right away, F5 outlined temporary mitigations for each critical bug. CVE-2026-15176 can be mitigated by avoiding the alias directive inside a location block and by not using the $request_filename variable. CVE-2026-97205 can be mitigated by turning off asynchronous file I/O, or AIO, or by disabling Server Side Includes. CVE-2026-93479 can be mitigated by using named captures in place of unnamed captures and confining them to the block containing the regex match.
F5 has not marked any of these vulnerabilities as exploited in the wild. Even so, the disclosure lands against a backdrop of repeated targeting of F5 products by both cybercriminal and nation-state groups in recent years. Attackers have used F5 flaws to break into corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents from victims around the world.
The U.S. Cybersecurity and Infrastructure Security Agency has flagged eight F5 vulnerabilities as actively exploited since November 2021, and four of those have also been used in ransomware attacks. In October 2025, F5 disclosed that state-sponsored actors had breached its systems in August 2025 and taken source code along with information on undisclosed BIG-IP security vulnerabilities.
F5 is a Fortune 500 company that provides cybersecurity, application delivery networking, and other services to more than 23,000 customers, a base that includes 80% of the Fortune Global 500 and 48 Fortune 50 companies. The broad enterprise footprint means the patching guidance and workarounds apply to a substantial share of large US organizations running NGINX in production.
More cybersecurity news from TechManNews.
