F5 has issued emergency security updates to resolve several NGINX web server problems, among them three high-risk flaws that could enable attackers to run code on vulnerable setups.

The three high-risk issues were identified in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) as well as the NGINX map directive (CVE-2026-93479).

Remote attackers without any special rights can leverage these to trigger denial-of-service conditions or achieve code execution on NGINX systems using non-standard configurations.

Successful attacks lead to heap-based buffer overflows or use-after-free conditions in the NGINX worker process, resulting in crashes or restarts. Attackers might further achieve code execution on systems where Address Space Layout Randomization is turned off or can be bypassed.

F5 has distributed security updates for multiple affected NGINX products, such as NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.

Teams unable to apply the updates immediately can address CVE-2026-15176 by avoiding the alias directive inside location blocks or the $request_filename variable, and CVE-2026-97205 by turning off asynchronous file I/O or Server Side Includes.

CVE-2026-93479 can be handled by switching to named captures instead of unnamed ones and restricting their use to the matching regex block.

Although F5 has not confirmed active exploitation of these issues, threat actors and nation-state groups have repeatedly targeted F5 products in recent years.

Attackers have used F5 flaws to infiltrate networks, scan internal systems, compromise devices, deploy destructive malware, and exfiltrate data from organizations around the world.

Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency has listed eight F5 vulnerabilities as actively exploited, with four also involved in ransomware campaigns.

One year earlier, in October 2025, F5 disclosed that state-sponsored actors had breached its systems in August 2025 and obtained source code along with details on undisclosed BIG-IP vulnerabilities.

F5 is a Fortune 500 company offering cybersecurity and application delivery services to more than 23,000 customers, including 80 percent of the Fortune Global 500 and 48 Fortune 50 firms.