# CERT-FR Warns of Multiple F5 NGINX Flaws

Published: 2026-10-19 · Severity: routine · Sectors: Technology, Infrastructure
Canonical: https://vorant.io/reports/287a6806-6099-558c-86c1-cdba7fffb0d3/cert-fr-warns-of-multiple-f5-nginx-flaws

> CERT-FR advisory lists multiple vulnerabilities in F5 NGINX products allowing remote code execution, denial of service, and data confidentiality breaches.

CERT-FR has published an advisory detailing multiple vulnerabilities affecting a wide range of F5 NGINX products, including NGINX Open Source, NGINX Plus, NGINX App Protect (WAF and DoS modules), NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and NGINX Javascript. The vulnerabilities span several versions across these products, with impacts including remote arbitrary code execution, remote denial of service, breach of data confidentiality, and security policy bypass. The exact exploitation status is not specified by the vendor.

Affected versions include NGINX Open Source prior to 1.30.6 and 1.31.x prior to 1.31.7, NGINX Plus prior to 37.1.0.1 and 37.0.5.1, NGINX Ingress Controller prior to 5.7.0 (and certain 2026-lts releases), NGINX Gateway Fabric prior to 2.8.0, NGINX Instance Manager 2.x prior to 2.24.0, F5 WAF for NGINX 5.x prior to 5.14.2/5.16.0, F5 DoS for NGINX 4.x prior to 4.11.0, and NGINX Javascript prior to 1.0.2. F5 published twelve separate security bulletins (K000162416 through K000163408) on 14 October 2026 covering eleven distinct CVEs.

Defenders running any F5 NGINX product family should consult the referenced F5 bulletins to identify applicable CVEs for their deployed versions and apply vendor patches promptly, given the breadth of products affected and the severity of potential impacts (RCE, DoS, data exposure).

## Mentioned in this report

- Vulnerabilities: CVE-2026-101019, CVE-2026-101025, CVE-2026-104939, CVE-2026-15176, CVE-2026-91184, CVE-2026-93479, CVE-2026-94197, CVE-2026-95101, CVE-2026-96615, CVE-2026-97205, CVE-2026-97629

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1341

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/287a6806-6099-558c-86c1-cdba7fffb0d3/cert-fr-warns-of-multiple-f5-nginx-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup