- Published
- Source
- CSO Online UK
- Filed under
- UK industry, Malware & exploits
- Vulnerabilities
- 3 CVEs
F5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial of service (DoS) attacks. OOB security patches are emergency software updates released outside of normal maintenance cycles. CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 are rated 9.2 in…
If you run the affected product
- Find every instance – especially the ones reachable from the internet.
- Apply the vendor's patch or mitigation now: exploited flaws are fixed in days, not at the next patch cycle.
- Then check for signs it was used before you patched: web shells, new accounts, unusual outbound traffic.
More helpCISA's Known Exploited Vulnerabilities catalogue (opens in a new tab)
The vulnerabilities in this story
CVE-2026-15176 in the NVD (opens in a new tab)
- CVSS8.1High
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
CVE-2026-97205 in the NVD (opens in a new tab)
- CVSS8.1High
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
CVE-2026-93479 in the NVD (opens in a new tab)
- CVSS8.1High
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
MyCyberWay training
Blue Team Analyst · Vulnerability Management
You can't patch everything at once. Learn what to fix first.
In our Blue Team Analyst programme you run a vulnerability scan, prioritise the output with CVSS, EPSS and asset criticality, and track remediation to closure with the teams who own the fix.
- Read scanner output properly
- Prioritise with CVSS, EPSS and asset criticality
- Track remediation to closure
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
