VulnerabilitiesJun 18, 2026

F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 patches two critical NGINX Open Source flaws enabling remote code execution.

F5 has released updates to address two critical vulnerabilities in NGINX Open Source, CVE-2026-42530 and CVE-2026-42055, both rated with a CVSS v4 score of 9.2. These flaws could allow remote, unauthenticated attackers to execute code on affected systems, particularly when ASLR is disabled or bypassed. Patches are available for various NGINX versions, with mitigations including disabling HTTP/3 or reconfiguring specific proxy directives.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run F5?

Get an email when a new story names F5, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Two critical vulnerabilities (CVE-2026-42530 and CVE-2026-42055) in NGINX Open Source allow remote, unauthenticated attackers to execute arbitrary code, earning a near-maximum CVSS v4 score of 9.2. The risk is compounded when Address Space Layout Randomization (ASLR) is disabled or can be bypassed, removing a key memory protection layer. NGINX is one of the most widely deployed web servers and reverse proxies in the world, making unpatched instances a high-value target across thousands of organizations. Because no authentication is required to exploit these flaws, any internet-facing NGINX instance running a vulnerable version is at immediate risk. Prompt patching combined with secure configuration practices is essential to prevent compromise.

What helps against this

How we list vendors

F5 affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleTenable Vulnerability Management Holm Security Platform Rapid7 Exposure Command (InsightVM)all options
Automated patch management
Known holes get closed in days, not months.
For exampleAction1 Patch Management Microsoft Intune ManageEngine Patch Manager Plus all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleWithSecure Elements XDR SentinelOne Singularity Endpoint Huntress Managed EDR all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-42530
cve — CVE-2026-42055

Entities

F5 (vendor)NGINX Open Source (product)NGINX Plus (product)NGINX Gateway Fabric (product)NGINX Instance Manager (product)NGINX Ingress Controller (product)