F5 Addresses Eleven NGINX Security Issues, Two Critical RCE Bugs

Key points

• F5 announced patches for 11 NGINX security flaws.
• Two CVEs (CVE-2026-15176, CVE-2026-93479) enable unauthenticated RCE.
• Adversaries can trigger the flaws using malicious HTTP requests.
• Severity is critical for the RCE issues, overall threat level medium.
• Admins should update NGINX immediately.

F5 has disclosed and resolved a set of security weaknesses in its NGINX offering. The vendor rolled out updates covering eleven distinct issues, a collection that includes several vulnerabilities. A pair from this set are cataloged under CVE-2026-15176 and CVE-2026-93479. Both permit remote code execution without requiring any authentication, and they are rated as critical.

Any organization running a vulnerable version of NGINX is exposed. This spans K-12 school districts, government bodies, and other entities that rely on NGINX as a web server, reverse proxy, or load balancer. Adversaries can trigger the flaws by sending specially formed HTTP requests, meaning no user action is needed.

Unauthenticated remote code execution ranks among the most dangerous vulnerability classes. An attacker could seize full control of the server, deploy malware, exfiltrate data, or move laterally within the network. For the education sector, this could result in breaches of student records or outages of essential online learning platforms.

F5 has addressed these flaws and announced fixes. The other nine issues vary in severity, but the two RCE bugs are the most pressing. The overall threat level is assessed as medium, yet the critical nature of the RCE vulnerabilities warrants immediate action.

Watch for exploitation attempts in server logs, particularly unusual HTTP requests. Apply patches without delay. Check for signs of compromise. Stay informed about further guidance from F5.

What to do now

1. Inventory all NGINX deployments and confirm their version numbers.
2. Apply the latest F5 security patches as soon as possible.
3. If immediate patching is not feasible, deploy virtual patching or WAF rules to block malicious HTTP requests.
4. Review NGINX and web server logs for indicators of exploitation, such as unusual request patterns.
5. Restrict network access to NGINX servers to trusted sources where operationally possible.
6. Enable automatic updates for NGINX if your environment supports it.
7. Conduct a compromise assessment on any system that may have been exposed.

CVE references

• CVE-2026-15176
• CVE-2026-93479

Original source

Security Affairs