F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.
The three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).
Remote attackers without privileges can exploit them to launch denial-of-service (DoS) attacks or gain code execution on NGINX systems with non-default configurations.
Successful exploitation causes a heap-based buffer overflow or use-after-free in the NGINX worker process, leading to crashes or a restart. However, attackers may also be able to "execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR."
F5 released security patches for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.
Security teams and admins who can't immediately install these security patches can mitigate CVE-2026-15176 by not using the 'alias' directive in a location block or the $request_filename variable, and CVE-2026-97205 by disabling asynchronous file I/O (AIO) or Server Side Includes (SSI).
CVE-2026-93479 can also be mitigated by using named captures instead of unnamed captures and limiting their use to the block with the regex match.
While F5 has not yet flagged these security issues as exploited in the wild, cybercrime and nation-state threat groups have often exploited vulnerabilities in F5 products in recent years.
For instance, attackers have targeted F5 security flaws to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents from victims worldwide.
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight F5 vulnerabilities as actively exploited, four of which have also been abused in ransomware attacks.
One year ago, in October 2025, F5 also disclosed that state-sponsored threat actors breached its systems in August 2025 and stole source code and information on undisclosed BIG-IP security vulnerabilities.
F5 is a Fortune 500 tech company that provides cybersecurity, application delivery networking (ADN), and other services to over 23,000 customers, including 80% of the Fortune Global 500 and 48 Fortune 50 companies.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.