Advisories
F5 NGINX Remote DoS & Data Integrity Flaw (CVE-2026-90439) – Patch Now
A critical flaw in F5’s NGINX Open Source has been exposed, letting attackers trigger a remote denial‑of‑service and corrupt data integrity. The vulnerability, identified as CVE‑2026‑90439, affects NGINX 1.31.x prior to 1.31.6 and 1.30.5. Immediate patching is essential. F5 has released a security bulletin detailing the fix; administrators should update or apply the vendor’s mitigation steps without delay.
A new critical vulnerability has been uncovered in F5’s NGINX Open Source, enabling attackers to cause a remote denial‑of‑service (DoS) and compromise data integrity. The flaw, catalogued as CVE‑2026‑90439, is exploitable on a range of older NGINX releases.
Impact
- Remote DoS – the affected server can be rendered unresponsive by a single crafted request.
- Data integrity breach – attackers can manipulate or corrupt data handled by the compromised instance.
Affected Versions
- NGINX Open Source 1.31.x – any release before 1.31.6
- NGINX Open Source 1.30.5
Mitigation
- Apply the latest patch released by F5, referenced in Security Bulletin K000162604.
- If immediate patching is not possible, follow the vendor’s temporary mitigation steps outlined in the bulletin.
- Verify that your deployment is not running a vulnerable version by checking the output of
nginx -vor equivalent.
Administrators are urged to act swiftly. Failing to patch exposes services to both disruption and data tampering, potentially violating compliance requirements and damaging customer trust.
Next Steps
- Review your infrastructure for the presence of the affected NGINX versions.
- Download and deploy the official patch from the F5 support portal.
- Test the updated configuration in a staging environment before rolling out to production.
- Monitor logs for anomalous activity that could indicate exploitation attempts.
Related vulnerabilities
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Cisco Finesse Remote File Inclusion Vulnerability (CVE‑2026‑20175) – Unauthenticated Browser Exploit
Cisco Finesse now contains a remote file inclusion flaw that lets attackers inject arbitrary files into a user’s session via crafted HTTP requests. The weakness arises from insufficient input validation, allowing unauthenticated, remote attackers to load malicious scripts into the browser and steal data. Cisco has released patches; no workarounds are available, so affected systems must be updated immediately.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing