F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication.

Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests.

Under certain conditions beyond their control, an unauthenticated attacker could exploit the security flaws to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE.

The flaw CVE-2026-15176 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code by sending crafted HTTP requests. The vulnerability occurs under specific configurations involving the alias directive and the $request_filename variable. Remote code execution may be possible if ASLR is disabled or bypassed.

The flaw CVE-2026-93479 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code through crafted HTTP requests. It affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions. Remote code execution may be possible if ASLR is disabled or bypassed.

The third critical flaw fixed by the vendor, tracked as CVE-2026-97205 (CVSS score of 9.2), is a use-after-free vulnerability in NGINX ngx_http_core_module that, under certain configurations with asynchronous file I/O (AIO) enabled, may cause memory corruption or unexpected worker process termination when processing Server Side Includes (SSI) pages containing include virtual commands. A remote attacker could exploit the flaw to cause a denial-of-service (DoS) or potentially execute code, particularly when ASLR is disabled or can be bypassed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NGINX)

F5 patched three NGINX vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) rated 9.2 Critical in F5 NGINX Plus and Open Source. Upgrade today.

Related Posts:

• Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
• Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws
• SiteGuard Server Edition Flaw CVE-2026-106931 Exploited in the Wild for Root Access

The post F5 Patches Three NGINX Vulnerabilities Allowing Memory Corruption and Remote Code Execution appeared first on Daily CyberSecurity.

F5 warns of a critical BIG-IP APM zero-day, CVE-2026-94127, allowing remote code execution. Attackers are already exploiting it.

F5 has released emergency security updates for a critical vulnerability, tracked as CVE-2026-94127 (CVSS score of 9.8), in BIG-IP Access Policy Manager (APM) that attackers are already exploiting in the wild.

The flaw can allow an unauthenticated attacker to execute arbitrary code on a vulnerable BIG-IP system. F5 disclosed the issue on September 22 and confirmed that exploitation had already been observed.

The vulnerability affects BIG-IP APM deployments using an access policy together with an OAuth profile on a virtual server. More specifically, the vulnerable configuration is one in which APM operates as an OAuth Authorization Server. Systems using APM only as an OAuth Client or Resource Server are not affected.

“When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. (CVE-2026-94127)” reads the advisory. “This vulnerability allows an unauthenticated attacker to perform RCE. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. We have learned that this vulnerability has been exploited.”

F5 says the affected versions include BIG-IP 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0. The company has released hotfixes for the vulnerable branches. The flaw affects the data plane rather than the BIG-IP management plane, and F5 says the appliance mode is also vulnerable.

The attack is particularly concerning because BIG-IP appliances are commonly positioned at the edge of corporate networks and handle authentication and access to internal applications. A successful compromise could therefore give an attacker a valuable position from which to move deeper into an organization’s infrastructure.

F5 has also provided indicators that defenders can use to look for signs of exploitation. The company recommends paying particular attention to environments showing repeated OAuth authentication failures followed by suspicious commands and, shortly afterward, a TMM SIGABRT event.

Organizations that cannot immediately install the hotfix can apply a temporary mitigation. F5 recommends deploying an iRule provided through its support channels to the affected BIG-IP APM virtual server. However, this should be considered a temporary measure rather than a replacement for the security update.

Shortly after F5 published its advisory, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog. US federal agencies were instructed to address the vulnerability by September 25, 2026.

Internet exposure also appears significant. Shadowserver is currently tracking more than 14,700 IP addresses showing BIG-IP APM fingerprints, although this number does not indicate how many systems are actually vulnerable or unpatched.

For organizations running BIG-IP APM, the immediate priority is to determine whether the affected OAuth configuration is in use, identify exposed systems, install the appropriate hotfix and review logs for possible compromise.

Because F5 has confirmed active exploitation, administrators should also treat patching as an incident-response priority rather than as routine vulnerability management.

F5 advisory and technical details: F5 BIG-IP APM security advisory

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, F5 BIG-IP)

An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes.

Related Posts:

• WordPress Stored XSS Details and PoC Publicly Disclosed
• Critical Next.js RCE Vulnerability Fixed in Version 16.3.6
• Critical IBM FTM Vulnerabilities Expose Financial Systems to Attack

The post Exploited BIG-IP APM Vulnerability Allows Remote Code Execution appeared first on Daily CyberSecurity.