F5 Issues Patches for Three Critical NGINX Vulnerabilities Allowing Code Execution

F5 released out-of-band security patches to address multiple vulnerabilities in its NGINX web server products, including three flaws rated as critical severity. According to BleepingComputer, these issues allow remote attackers to execute code on vulnerable systems or launch denial-of-service attacks against servers with non-default configurations.

The critical vulnerabilities reside in the ngx_http_v3_module and the NGINX map directive. Specifically, CVE-2026-15176 and CVE-2026-97205 are located in the HTTP/3 module, while CVE-2026-93479 affects the map directive. Successful exploitation of these flaws triggers a heap-based buffer overflow or a use-after-free condition within the NGINX worker process. This can cause the server to crash or restart, and in some cases, allows attackers to execute arbitrary code if Address Space Layout Randomization is disabled or bypassed.

Context and Background

F5 has not indicated that these specific security issues are currently being exploited in the wild. However, the company’s products have been frequent targets for cybercrime and nation-state groups in recent years. Attackers have previously leveraged F5 flaws to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents from victims globally.

The U.S. Cybersecurity and Infrastructure Security Agency has flagged eight F5 vulnerabilities as actively exploited since November 2021. Four of those previously identified flaws were also abused in ransomware attacks. Additionally, in October 2025, F5 disclosed that state-sponsored threat actors breached its systems the previous month, stealing source code and information regarding undisclosed BIG-IP security vulnerabilities.

Who Is Affected

The security patches address vulnerabilities across multiple NGINX software products offered by F5. Affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Organizations using any of these components should verify their current versions and apply the relevant updates to protect against potential remote exploitation.

What should you do?

Security teams that cannot immediately install the patches can apply specific mitigations to reduce risk. For CVE-2026-15176, administrators should avoid using the 'alias' directive in location blocks or the $request_filename variable. For CVE-2026-97205, disabling asynchronous file I/O or Server Side Includes can help prevent exploitation. CVE-2026-93479 can be mitigated by using named captures instead of unnamed ones and limiting their scope to the block with the regex match.

What to do and how to stay safe: F5

• Inventory all NGINX instances, including Plus, Open Source, and controller variants, to determine exposure to the affected modules.
• Apply the out-of-band patches provided by F5 to all vulnerable systems as soon as possible to close the critical execution paths.
• If immediate patching is not feasible, implement the recommended configuration changes, such as disabling the alias directive or asynchronous file I/O.
• Monitor server logs for signs of heap-based buffer overflows or unexpected worker process crashes that may indicate exploitation attempts.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with these critical NGINX vulnerabilities?

The vulnerabilities are identified as CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479.

Can these vulnerabilities lead to remote code execution?

Yes, attackers can execute code on systems where Address Space Layout Randomization is disabled or can be bypassed.

Are these flaws currently being exploited in the wild?

F5 has not flagged these specific security issues as actively exploited in the wild at this time.