# F5 NGINX Products Hit by Multiple Vulnerabilities

Published: 2026-10-15 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/88ed2934-b61f-51ab-9387-342798362f52/f5-nginx-products-hit-by-multiple-vulnerabilities

> CERT-FR warns of multiple vulnerabilities in F5 NGINX product line enabling remote code execution, data exposure, and denial of service.

CERT-FR issued an advisory covering multiple vulnerabilities across the F5 NGINX product portfolio, including F5 DoS for NGINX, F5 WAF for NGINX, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX Instance Manager, NGINX Open Source, and NGINX Plus. The flaws collectively allow an attacker to achieve remote code execution, compromise data confidentiality and integrity, and cause remote denial of service, depending on the specific product and version affected.

Five CVEs are referenced (CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629) tied to five separate F5 security bulletins published on 14 October 2026. No exploitation in the wild is mentioned in the advisory. Affected versions span F5 DoS for NGINX below 4.11.0, F5 WAF for NGINX below 5.16.0, NGINX Gateway Fabric below 2.8.0, NGINX Ingress Controller below 5.7.0, NGINX Instance Manager below 2.24.0, NGINX Open Source below 1.31.7, and NGINX Plus below 37.2.0.

Defenders running any of these NGINX-based products should consult the linked F5 bulletins (K000162416, K000162606, K000162607, K000162608, K000162613) and apply vendor patches promptly given the breadth of impact, which includes RCE on widely deployed web/proxy infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629

## Detection guidance (public sample)

### NGINX Process Spawning Shell or Download/Interpreter Child

ATT&CK: T1190

Detects an nginx master/worker process spawning a shell, scripting interpreter, or download/netcat utility on Linux, a common post-exploitation sign of RCE in NGINX-based products. The advisory gives no exploit details, so this is a generic RCE-consequence detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: NGINX Process Spawning Shell or Download/Interpreter Child
id: 61cebb82-ce3b-5179-955f-4d29e1192862
status: experimental
description: Detects an nginx master or worker process spawning a shell, scripting
  interpreter, or download/netcat utility on Linux. A web server or proxy process
  rarely executes these directly, so a hit is a strong post-exploitation sign of remote
  code execution in NGINX-based products (Open Source, Plus, Ingress Controller, Gateway
  Fabric, Instance Manager, WAF/DoS modules). Generic RCE-consequence detection, not
  tied to a specific CVE.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1317
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /nginx
    - /nginx-ingress
    - /nginx-agent
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
    - /zsh
    - /python
    - /python2
    - /python3
    - /perl
    - /ruby
    - /php
    - /curl
    - /wget
    - /nc
    - /ncat
    - /busybox
  filter_nginx_reexec:
    CommandLine|contains:
    - nginx -t
    - nginx -s
  condition: selection_parent and selection_child and not filter_nginx_reexec
falsepositives:
- Container entrypoint or health-check scripts that run shell commands under an nginx
  parent process
- Ingress controller reload wrappers that invoke sh to test or reload configuration
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1317

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/88ed2934-b61f-51ab-9387-342798362f52/f5-nginx-products-hit-by-multiple-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup