F5 deployed out-of-band patches to remediate multiple NGINX web server vulnerabilities, with three rated at critical severity that enable remote code execution on compromised installations. The flaws affect the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).

Unauthenticated attackers can leverage these vulnerabilities to conduct denial-of-service attacks or achieve code execution on NGINX instances running non-default setups. Exploitation typically results in a heap-based buffer overflow or use-after-free condition within the NGINX worker process, causing service crashes or restarts. In certain scenarios, particularly when Address Space Layout Randomization (ASLR) is disabled or can be circumvented, attackers may gain the ability to "execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR."

The patches cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.

Mitigation Strategies

Organizations unable to deploy patches immediately can implement workarounds. For CVE-2026-15176, avoid using the 'alias' directive within location blocks or the $request_filename variable. CVE-2026-97205 can be mitigated by turning off asynchronous file I/O (AIO) or Server Side Includes (SSI). CVE-2026-93479 mitigation involves substituting named captures for unnamed captures and restricting their scope to the block containing the regex match.

Threat Context

Although F5 has not documented active exploitation of these specific flaws, F5 products have become frequent targets for both cybercriminal and state-sponsored actors. Previous attacks leveraging F5 vulnerabilities have enabled network breaches, internal server reconnaissance, device hijacking, malware deployment, and theft of confidential information across global organizations.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has designated eight F5 vulnerabilities as actively exploited since November 2021, with four subsequently weaponized in ransomware campaigns. In October 2025, F5 disclosed that state-sponsored actors had compromised its infrastructure in August 2025, obtaining source code and intelligence regarding undisclosed BIG-IP security flaws.

F5 operates as a Fortune 500 enterprise delivering cybersecurity, application delivery networking (ADN), and related solutions to more than 23,000 clients worldwide, encompassing 80% of the Fortune Global 500 and 48 of the Fortune 50.