F5 issues emergency patches for critical NGINX flaws allowing code execution

Three critical vulnerabilities affect NGINX modules; no active exploitation reported but past incidents raise concern

By LineZotpaper

Published20 October 2026

Read Time2 min

F5 has released out-of-band security patches to address multiple vulnerabilities in its NGINX web server software, including three critical flaws that could allow remote attackers to execute code on vulnerable systems. The company is urging administrators to apply the updates promptly, though it has not yet observed active exploitation of the issues.

F5 issued the emergency patches on October 19, covering three critical-severity vulnerabilities found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479). Remote attackers without privileges can exploit these flaws on systems with non-default configurations, causing heap-based buffer overflows or use-after-free conditions in the NGINX worker process. Successful exploitation can lead to denial-of-service (DoS) attacks, crashes, or code execution on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed.

The affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. For administrators unable to install the patches immediately, F5 has provided mitigations. CVE-2026-15176 can be mitigated by avoiding the 'alias' directive in location blocks or the $request_filename variable. CVE-2026-97205 can be mitigated by disabling asynchronous file I/O (AIO) or Server Side Includes (SSI). CVE-2026-93479 can be mitigated by using named captures instead of unnamed captures and limiting their use to the block containing the regex match.

While F5 has not flagged these specific vulnerabilities as exploited in the wild, cybercrime and nation-state threat groups have frequently targeted F5 products in recent years. Attackers have exploited previous F5 flaws to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed eight F5 vulnerabilities as actively exploited, four of which have been used in ransomware attacks. In October 2025, F5 disclosed that state-sponsored actors had breached its systems in August 2025, stealing source code and information on undisclosed BIG-IP security vulnerabilities.

F5 is a Fortune 500 technology company providing cybersecurity, application delivery networking, and other services to over 23,000 customers, including 80% of the Fortune Global 500 and 48 Fortune 50 companies.

Analysis

Why This Matters

Critical vulnerabilities in NGINX, a widely used web server and reverse proxy, expose a large number of enterprise customers to potential code execution and DoS attacks.
Past exploitation of F5 products by ransomware groups and state-sponsored actors indicates these flaws are likely to be targeted once exploits become available.
The need for urgent patching, especially by organizations using non-default configurations that increase exposure.

Background

F5 provides application delivery and security services to major enterprises globally, with NGINX being one of its flagship products. Over the years, multiple vulnerabilities in F5 products have been actively exploited by threat actors ranging from cybercrime groups to nation-state hackers. In 2025, F5 itself was breached by state-sponsored attackers who stole source code and information about undisclosed vulnerabilities. The current set of flaws affects core NGINX modules and can be triggered by unauthenticated remote attackers under certain conditions.

Key Perspectives

Security teams: Face the challenge of patching critical vulnerabilities in production systems, with the option to apply workarounds if immediate patching is not feasible. The historical pattern of exploitation adds urgency. F5: Has released out-of-band patches and detailed mitigation steps, encouraging rapid deployment. The company has not reported active exploitation of these specific CVEs. Attackers: While no in-the-wild exploitation has been confirmed, the critical severity and past targeting of F5 products suggest attempts are likely, especially once technical details become public.

What to Watch

Whether CISA adds these CVEs to its Known Exploited Vulnerabilities catalog, which would indicate active exploitation.
Reports of proof-of-concept code or actual attacks leveraging these flaws, particularly against systems with ASLR disabled.
The speed and breadth of patch deployment across NGINX user organizations, especially those in high-value sectors like finance and government.

Sources

F5 releases out-of-band patches for critical NGINX vulnerabilities · BleepingComputer

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedF5 issues emergency patches for critical NGINX flaws allowing code executionBleepingComputer: “F5 releases out-of-band patches for critical NGINX vulnerabilities. F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.”
SupportedThree critical vulnerabilities affect NGINX modules; no active exploitation reported but past incidents raise concernBleepingComputer: “three critical-severity vulnerabilities ... While F5 has not yet flagged these security issues as exploited in the wild, cybercrime and nation-state threat groups have often exploited vulnerabilities in F5 products in recent years.”
Not in the sourcesF5 issued the emergency patches on October 19
SupportedThree critical-severity vulnerabilities found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479)BleepingComputer: “three critical vulnerabilities were found in the ngx_http_v3_module ( CVE-2026-15176 and CVE-2026-97205 ) and the NGINX map directive ( CVE-2026-93479 )”
SupportedRemote attackers without privileges can exploit these flaws on systems with non-default configurations, causing heap-based buffer overflows or use-after-free conditions in the NGINX worker processBleepingComputer: “Remote attackers without privileges can exploit them to launch denial-of-service (DoS) attacks or gain code execution on NGINX systems with non-default configurations. Successful exploitation causes a heap-based buffer overflow or use-after-free in the NGINX worker process, leading to crashes or a restart.”
SupportedSuccessful exploitation can lead to denial-of-service (DoS) attacks, crashes, or code execution on systems where ASLR is disabled or can be bypassedBleepingComputer: “However, attackers may also be able to 'execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.'”
SupportedThe affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance ManagerBleepingComputer: “F5 released security patches for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.”
SupportedF5 has provided mitigations for each vulnerability: avoid 'alias' directive, disable AIO or SSI, use named capturesBleepingComputer: “can mitigate CVE-2026-15176 by not using the 'alias' directive in a location block or the $request_filename variable, and CVE-2026-97205 by disabling asynchronous file I/O (AIO) or Server Side Includes (SSI). CVE-2026-93479 can also be mitigated by using named captures instead of unnamed captures and limiting their use to the block with the regex match.”
SupportedF5 has not flagged these specific vulnerabilities as exploited in the wild, but cybercrime and nation-state groups have frequently targeted F5 products in recent yearsBleepingComputer: “While F5 has not yet flagged these security issues as exploited in the wild, cybercrime and nation-state threat groups have often exploited vulnerabilities in F5 products in recent years.”
SupportedAttackers have exploited previous F5 flaws to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documentsBleepingComputer: “attackers have targeted F5 security flaws to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents from victims worldwide.”
SupportedSince November 2021, CISA has listed eight F5 vulnerabilities as actively exploited, four of which have been used in ransomware attacksBleepingComputer: “Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight F5 vulnerabilities as actively exploited, four of which have also been abused in ransomware attacks.”
SupportedIn October 2025, F5 disclosed that state-sponsored actors had breached its systems in August 2025, stealing source code and information on undisclosed BIG-IP security vulnerabilitiesBleepingComputer: “One year ago, in October 2025, F5 also disclosed that state-sponsored threat actors breached its systems in August 2025 and stole source code and information on undisclosed BIG-IP security vulnerabilities.”