CVE-2026-93479
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… EPSS 0.6% (45th percentile). Microsoft patch: Release Notes.
Vulnerabilities · 4h ago
F5 issued out-of-band patches for three critical flaws in NGINX Open Source and NGINX Plus that can let attackers execute code on vulnerable systems. The flaws are CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205.
The reported issues involve unusual combinations of rewrite rules or regular-expression captures that can cause unsafe handling inside NGINX. If exploited, that could give an attacker code execution on the vulnerable server; the reporting does not describe a more specific attack sequence.
Both commercial and open-source deployments are in scope, so teams running NGINX without an F5 subscription may still have affected servers. The available reporting does not establish that attackers are exploiting the flaws.
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… EPSS 0.6% (45th percentile). Microsoft patch: Release Notes.
CVSS 8.1 HIGH: a vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias… Microsoft patch: Release Notes.
CVSS 8.1 HIGH: nGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. Microsoft patch: Release Notes.
2 sources covering this story
F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.
F5: risolte vulnerabilità nei prodotti NGINX
F5 ha rilasciato aggiornamenti di sicurezza che sanano alcune vulnerabilità, di cui 3 con gravità "critica" e 6 con gravità "alta", in prodotti NGINX, noto software per la gestione del traffico e degli applicativi web.
Part of the PlainSec briefing for 2026-10-19