Security Intelligence
Loading table of contents...
At a glance:
-
F5 issued security updates for eight vulnerabilities affecting NGINX and BIG-IP products.
-
The most severe issue could allow a remote, unauthenticated threat actor to disrupt NGINX services and, under specific conditions, execute code on the affected server.
-
Review exposed systems, prioritize vendor updates, and implement config. and access control recommendations to reduce exposure while upgrades are completed.
Threat summary
On July 15, 2026, F5 released an out-of-band security update addressing eight vulnerabilities across NGINX and BIG-IP product lines.
NGINX is widely used as a web server, reverse proxy, load balancer, and application delivery platform. Many organizations rely on NGINX to publish internet-facing applications, application programming interfaces (APIs), and Kubernetes services.
The most critical issue, CVE-2026-42533, received a CVSS score of 9.2 and affects:
-
NGINX Plus
-
NGINX Open Source
-
NGINX Instance Manager
-
NGINX Ingress Controller
-
NGINX Gateway Fabric
-
Several F5 security products built on NGINX
The vulnerability affects deployments that use the NGINX map directive with regular expression matching. A remote, unauthenticated threat actor could send crafted HTTP requests that trigger a heap buffer overflow, causing NGINX worker process restarts and service disruption. In environments where Address Space Layout Randomization (ASLR) is disabled, successful exploitation may result in code execution on the affected server.
F5 classifies the issue as a data-plane vulnerability and recommends replacing unnamed regular-expression captures with named captures as a workaround until updates are applied.
F5 also patched two high-severity NGINX vulnerabilities, CVE-2026-60005 and CVE-2026-56434. The former may allow a threat actor to expose portions of process memory or trigger NGINX worker process restarts, while the latter may lead to memory corruption and service instability. Both affect core NGINX processing functions and could impact the availability and integrity of internet-facing services.
Two additional high-severity vulnerabilities, CVE-2026-55723 and CVE-2026-52865, affect NGINX Ingress Controller deployments used in Kubernetes environments. These vulnerabilities require authentication and relevant Kubernetes permissions. Successful exploitation may allow a threat actor to inject NGINX configuration directives, delete files, disable services, or create denial-of-service conditions through malicious modification of Ingress or TransportServer resources. Organizations operating containerized applications and Kubernetes clusters that use NGINX Ingress Controller face the highest exposure.
F5 also addressed CVE-2026-59762, a high-severity denial-of-service vulnerability affecting BIG-IP, BIG-IP Next Service Proxy for Kubernetes (SPK), BIG-IP Next Cloud-Native Function (CNF), and BIG-IP Next for Kubernetes. A remote, unauthenticated threat actor could consume excessive memory resources on systems where an HTTP/2 profile is configured, resulting in service degradation or interruption. BIG-IP products are commonly used to provide load balancing, application delivery, and traffic management services for business-critical applications.
F5 also addressed CVE-2026-60062, which affects NGINX Agent and NGINX Instance Manager, and CVE-2026-60065, which affects NGINX Plus, F5 WAF for NGINX, NGINX App Protect WAF, NGINX Gateway Fabric, and NGINX Ingress Controller. Both vulnerabilities were included in F5's July 15 out-of-band security release and affect components used to manage or process NGINX traffic across enterprise environment
Insights & mitigations
Organizations using affected NGINX or BIG-IP products would benefit from applying the July 15 security updates and prioritizing internet-facing NGINX systems, Kubernetes ingress infrastructure, NGINX management platforms, and BIG-IP deployments supporting critical applications. Fixed releases are available for all eight vulnerabilities covered by F5's advisory.
For CVE-2026-42533 and CVE-2026-60005, F5 recommends replacing unnamed regular-expression captures with named captures in affected NGINX configurations. These vulnerabilities are tied to specific NGINX regular-expression processing patterns, and the configuration change reduces exposure until upgrades are completed.
For CVE-2026-55723 and CVE-2026-52865, F5 recommends restricting Kubernetes role-based access control (RBAC) permissions for Ingress, VirtualServer, VirtualServerRoute, Policy, and related resources to trusted administrators. Both vulnerabilities require authenticated access and Kubernetes permissions, making access control the primary mitigation beyond patching. F5 also recommends admission policies that validate user-controlled fields before configuration changes are accepted.
For CVE-2026-56434, CVE-2026-60065, CVE-2026-60062, and CVE-2026-59762, F5's guidance focuses on upgrading to fixed releases.
Organizations using NGINX Agent, NGINX Instance Manager, BIG-IP, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, F5 WAF for NGINX, or NGINX App Protect WAF would benefit from validating software versions, applying vendor updates, and reviewing exposed systems to identify affected assets.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)