F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical vulnerabilities that allow remote attackers to execute code.
The vulnerability or weakness
Not stated in the sources.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-15176 | 9.2 | CRITICAL | No | - |
| CVE-2026-93479 | 9.2 | CRITICAL | No | - |
| CVE-2026-97205 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This could lead to crashes, restarts, or code execution, potentially disrupting operations and leading to data breaches or other security incidents. Organizations must act swiftly to mitigate the risks.
Industries affected
These vulnerabilities impact a wide range of industries, including finance, healthcare, and tech, as NGINX is used by over 23,000 customers, including 80% of the Fortune Global 500.
Users affected
Users and customers of F5's NGINX products, such as NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager, are directly affected and need to update their systems immediately.
Build these skills
Watch the daily brief
Sources
- F5 releases out-of-band patches for critical NGINX vulnerabilities (BleepingComputer)
