CERT-FR Warns of Multiple F5 NGINX Flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory lists multiple vulnerabilities in F5 NGINX products allowing remote code execution, denial of service, and data confidentiality breaches.
CERT-FR has published an advisory detailing multiple vulnerabilities affecting a wide range of F5 NGINX products, including NGINX Open Source, NGINX Plus, NGINX App Protect (WAF and DoS modules), NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and NGINX Javascript. The vulnerabilities span several versions across these products, with impacts including remote arbitrary code execution, remote denial of service, breach of data confidentiality, and security policy bypass. The exact exploitation status is not specified by the vendor.
Affected versions include NGINX Open Source prior to 1.30.6 and 1.31.x prior to 1.31.7, NGINX Plus prior to 37.1.0.1 and 37.0.5.1, NGINX Ingress Controller prior to 5.7.0 (and certain 2026-lts releases), NGINX Gateway Fabric prior to 2.8.0, NGINX Instance Manager 2.x prior to 2.24.0, F5 WAF for NGINX 5.x prior to 5.14.2/5.16.0, F5 DoS for NGINX 4.x prior to 4.11.0, and NGINX Javascript prior to 1.0.2. F5 published twelve separate security bulletins (K000162416 through K000163408) on 14 October 2026 covering eleven distinct CVEs.
Defenders running any F5 NGINX product family should consult the referenced F5 bulletins to identify applicable CVEs for their deployed versions and apply vendor patches promptly, given the breadth of products affected and the severity of potential impacts (RCE, DoS, data exposure).
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1341
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,623 reports from 145 sources, 566 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs