F5 NGINX Products Hit by Multiple Vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR warns of multiple vulnerabilities in F5 NGINX product line enabling remote code execution, data exposure, and denial of service.
CERT-FR issued an advisory covering multiple vulnerabilities across the F5 NGINX product portfolio, including F5 DoS for NGINX, F5 WAF for NGINX, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX Instance Manager, NGINX Open Source, and NGINX Plus. The flaws collectively allow an attacker to achieve remote code execution, compromise data confidentiality and integrity, and cause remote denial of service, depending on the specific product and version affected.
Five CVEs are referenced (CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629) tied to five separate F5 security bulletins published on 14 October 2026. No exploitation in the wild is mentioned in the advisory. Affected versions span F5 DoS for NGINX below 4.11.0, F5 WAF for NGINX below 5.16.0, NGINX Gateway Fabric below 2.8.0, NGINX Ingress Controller below 5.7.0, NGINX Instance Manager below 2.24.0, NGINX Open Source below 1.31.7, and NGINX Plus below 37.2.0.
Defenders running any of these NGINX-based products should consult the linked F5 bulletins (K000162416, K000162606, K000162607, K000162608, K000162613) and apply vendor patches promptly given the breadth of impact, which includes RCE on widely deployed web/proxy infrastructure.
Mentioned in this report
Detection guidance
NGINX Process Spawning Shell or Download/Interpreter Child
Detects an nginx master/worker process spawning a shell, scripting interpreter, or download/netcat utility on Linux, a common post-exploitation sign of RCE in NGINX-based products. The advisory gives no exploit details, so this is a generic RCE-consequence detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NGINX Process Spawning Shell or Download/Interpreter Child
id: 61cebb82-ce3b-5179-955f-4d29e1192862
status: experimental
description: Detects an nginx master or worker process spawning a shell, scripting
interpreter, or download/netcat utility on Linux. A web server or proxy process
rarely executes these directly, so a hit is a strong post-exploitation sign of remote
code execution in NGINX-based products (Open Source, Plus, Ingress Controller, Gateway
Fabric, Instance Manager, WAF/DoS modules). Generic RCE-consequence detection, not
tied to a specific CVE.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1317
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /nginx
- /nginx-ingress
- /nginx-agent
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
- /zsh
- /python
- /python2
- /python3
- /perl
- /ruby
- /php
- /curl
- /wget
- /nc
- /ncat
- /busybox
filter_nginx_reexec:
CommandLine|contains:
- nginx -t
- nginx -s
condition: selection_parent and selection_child and not filter_nginx_reexec
falsepositives:
- Container entrypoint or health-check scripts that run shell commands under an nginx
parent process
- Ingress controller reload wrappers that invoke sh to test or reload configuration
level: high
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1317
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs