CVE-2026-93479
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… EPSS 0.6% (45th percentile). Microsoft patch: Release Notes.
Vulnerabilities & Exploits
F5 issued out-of-band patches for three critical flaws in NGINX Open Source and NGINX Plus that can let attackers execute code on vulnerable systems. The flaws are CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205.
The reported issues involve unusual combinations of rewrite rules or regular-expression captures that can cause unsafe handling inside NGINX. If exploited, that could give an attacker code execution on the vulnerable server; the reporting does not describe a more specific attack sequence.
Both commercial and open-source deployments are in scope, so teams running NGINX without an F5 subscription may still have affected servers. The available reporting does not establish that attackers are exploiting the flaws.
2 sources · 5h ago
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… EPSS 0.6% (45th percentile). Microsoft patch: Release Notes.
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias… Microsoft patch: Release Notes.
CVSS 8.1 HIGH: nGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. Microsoft patch: Release Notes.
BleepingComputer
F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.
originalCSIRT Italia / ACN
F5: risolte vulnerabilità nei prodotti NGINX
F5 ha rilasciato aggiornamenti di sicurezza che sanano alcune vulnerabilità, di cui 3 con gravità "critica" e 6 con gravità "alta", in prodotti NGINX, noto software per la gestione del traffico e degli applicativi web.
originalPart of the PlainSec briefing for 2026-10-19
Every edition of this story: F5 patches three NGINX flaws enabling code execution