NGINX RCE flaws exploited in wild
Four vulnerabilities in NGINX, including an exploited heap overflow (CVE-2026-42945), enable remote code execution on systems without ASLR; PoC published.
Multiple critical vulnerabilities have been disclosed in NGINX web server software affecting versions from 0.6.27 through 1.30.0, NGINX Plus R32-R36, and related F5 products. The most severe flaw, CVE-2026-42945, is a heap buffer overflow in ngx_http_rewrite_module that allows remote code execution on systems with ASLR disabled. VulnCheck reports this vulnerability is already being exploited in the wild, and DepthFirst has published proof-of-concept code.
The vulnerability set includes three additional flaws: CVE-2026-42946 (excessive memory allocation causing worker crashes), CVE-2026-40701 (use-after-free in TLS/OCSP handling), and CVE-2026-42934 (out-of-bounds read in charset processing). Unauthenticated attackers can exploit these by sending crafted HTTP requests to crash NGINX worker processes or, in the case of CVE-2026-42945 on vulnerable configurations, achieve arbitrary code execution.
MS-ISAC rates the risk as high for government and business environments. Organizations running affected NGINX versions should apply vendor patches immediately, particularly given confirmed in-the-wild exploitation. The advisory emphasizes defense-in-depth measures including network segmentation, least-privilege principles, and vulnerability scanning to mitigate exploitation risk.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by NGINX Worker
Detects nginx master/worker process spawning a shell or scripting interpreter, consistent with post-exploitation of an NGINX RCE vulnerability such as CVE-2026-42945. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by NGINX Worker
status: experimental
description: Detects a shell, scripting interpreter, or download utility being spawned
as a child of the nginx process, which is not expected behaviour for a web server
worker and may indicate successful exploitation of an NGINX RCE vulnerability (e.g.
CVE-2026-42945).
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /nginx
- /sbin/nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
- /zsh
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
- /socat
filter:
CommandLine|contains:
- logrotate
- certbot
- reload
- -s reload
- -s stop
condition: selection_parent and selection_child and not filter
falsepositives:
- Package manager or configuration management scripts invoking shell utilities via
nginx init/service wrapper scripts
- Certbot or logrotate hooks that call shell scripts through the nginx service manager
level: high
tags:
- attack.t1190
- attack.execution
id: a7fcf74b-5de1-5ce9-8d69-3c628f915b41
author: Vorant
Outbound Network Connection Initiated by NGINX Process
Detects nginx establishing an outbound network connection to a non-standard destination port, which may indicate a reverse shell or callback following exploitation of an NGINX RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Network Connection Initiated by NGINX Process
status: experimental
description: Detects the nginx process initiating an outbound network connection to
a port outside typical web/health-check/upstream ranges, which can indicate a reverse
shell or command-and-control callback established after successful exploitation
of an NGINX RCE such as CVE-2026-42945.
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- /nginx
- /sbin/nginx
Initiated: 'true'
filter:
DestinationPort:
- 80
- 443
- 8080
- 8443
- 53
condition: selection and not filter
falsepositives:
- NGINX configured as a reverse proxy or load balancer connecting to upstream application
servers on non-standard ports
- Health-check or monitoring agents co-located with nginx performing outbound checks
level: medium
tags:
- attack.t1190
- attack.command_and_control
id: 0f57966e-1790-5d16-ad03-6d85abfa77ef
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-nginx-could-allow-for-remote-code-execution_2026-051
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free