F5 releases emergency patches for three critical NGINX flaws
F5 issues out-of-band updates to fix heap buffer overflows in NGINX that could allow remote code execution and denial of service attacks.
Key points
- Three critical vulnerabilities in NGINX carry a CVSS 4.0 score of 9.2
- Flaws include CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479
- Patches address heap buffer overflows that may enable remote code execution
F5 Networks has released emergency out-of-band security patches to address three critical vulnerabilities in its NGINX software suite. The updates fix flaws that could allow attackers to execute remote code, crash systems, or launch denial-of-service attacks against affected infrastructure.
The three vulnerabilities, identified as CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479, are each rated at a severity of 9.2 under the Common Vulnerability Scoring System version 4.0. F5 issued these patches outside of its normal maintenance cycle to expedite remediation for users of its high-performance traffic control software.
Technical details of the flaws
According to CSO Online, CVE-2026-15176 and CVE-2026-97205 exist in the ngx_http_core_module of F5’s NGINX platform. These defects can cause a heap buffer overflow within the server’s worker process, potentially leading to system crashes or restarts. Attackers might exploit this memory corruption to gain access to the system or execute arbitrary code.
The risk of code execution increases if Address Space Layout Randomization is disabled on the target system or if attackers can bypass this memory protection technique. F5 noted that these flaws also enable threat actors to launch denial-of-service attacks, rendering the server inaccessible to legitimate users and disrupting web traffic flow.
The third vulnerability, CVE-2026-93479, involves a map directive flaw. Attackers can send crafted HTTP requests to trigger a heap buffer overflow similar to the other two issues. This defect also allows for code execution when ASLR is disabled or bypassed, posing a significant risk to systems relying on NGINX for request handling.
Scope of impact and analyst perspective
The affected software products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. These tools are widely used to control digital traffic for websites, manage load balancing, and handle Kubernetes ingress, making them critical components of many enterprise architectures.
Frank Dickson of Dickson Research described NGINX as the "front door" for many organizations, noting that Transport Layer Security often terminates at this layer. He warned that code execution on such a box could expose passwords, session cookies, API tokens, and private keys in clear text, compromising the trust model of the entire infrastructure.
F5 stated it has not discovered evidence that these specific issues are being exploited in the wild. However, the vendor strongly advises customers to install or upgrade to the fixed versions immediately. This disclosure follows F5’s June announcement of CVE-2026-42530, another flaw in NGINX Open Source that could potentially allow remote denial-of-service or code execution.
What should you do?
Administrators should verify which versions of NGINX Plus, Open Source, or related controllers they are running. F5 recommends applying the latest out-of-band patches as soon as possible to mitigate the risk of remote code execution and system crashes. Organizations should also review their ASLR configurations to ensure memory protection mechanisms are active and not easily bypassed.
What to do and how to stay safe: F5
- Inventory all systems running NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, or Instance Manager to identify exposure.
- Apply the emergency out-of-band patches released by F5 to address CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479.
- Verify that Address Space Layout Randomization is enabled on affected servers to reduce the likelihood of successful code execution.
- Monitor server logs for signs of heap buffer overflow attempts or unusual HTTP requests that may indicate exploitation attempts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these NGINX vulnerabilities currently being exploited in the wild?
F5 has stated that it has not discovered evidence of exploitation in the wild for these specific flaws.
Which specific CVEs are included in this emergency patch?
The patches address CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479.
What is the severity rating of these vulnerabilities?
All three vulnerabilities are rated at a severity of 9.2 under CVSS version 4.0.
