**F5** has issued an urgent call to action for users of its **NGINX** web server, releasing out-of-band security patches to mitigate several critical vulnerabilities. These flaws pose significant risks, including remote code execution (RCE) and denial-of-service (DoS) attacks. ### Critical Vulnerabilities Detailed The three most severe vulnerabilities, rated as critical, are: * **CVE-2026-15176** (ngx_http_v3_module) * **CVE-2026-97205** (ngx_http_v3_module) * **CVE-2026-93479** (NGINX map directive) These vulnerabilities can be exploited by unprivileged remote attackers, leading to heap-based buffer overflows or use-after-free conditions in the **NGINX** worker process. While such exploits typically cause crashes or restarts, the potential for code execution is present, especially on systems with **Address Space Layout Randomization (ASLR)** disabled or when attackers can bypass **ASLR**. ### Affected Products and Mitigation **F5** has released security patches for a wide range of **NGINX** software products, including: * **NGINX Plus** * **NGINX Open Source** * **NGINX Ingress Controller** * **NGINX Gateway Fabric** * **NGINX Instance Manager** For organizations unable to apply patches immediately, **F5** has provided specific mitigation strategies: * **CVE-2026-15176**: Avoid using the 'alias' directive in a location block or the `$request_filename` variable. * **CVE-2026-97205**: Disable asynchronous file I/O (**AIO**) or **Server Side Includes (SSI)**. * **CVE-2026-93479**: Utilize named captures instead of unnamed captures, limiting their use to the block with the regex match. ### A History of Targeted Exploits Although **F5** has not yet confirmed in-the-wild exploitation of these specific vulnerabilities, the company's products have been a frequent target for cybercrime and nation-state threat groups. In recent years, attackers have leveraged **F5** security flaws to: * Breach corporate networks * Map internal servers * Hijack devices * Deploy data-wiping malware * Steal sensitive documents The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** has listed eight **F5** vulnerabilities in its Known Exploited Vulnerabilities Catalog since November 2021, with four of these also abused in ransomware attacks. Notably, in October 2025, **F5** disclosed a breach by state-sponsored actors in August 2025, resulting in the theft of source code and information related to undisclosed **BIG-IP** security vulnerabilities. Given **F5**'s significant market presence, serving over 23,000 customers including 80% of the Fortune Global 500, prompt patching and vigilance are paramount.