[UPDATE] [high] NGINX Open Source and NGINX Plus: Multiple vulnerabilities

highCVE-2026-42945 CVE-2026-40460 CVE-2026-40701 CVE-2026-42926 CVE-2026-42934 CVE-2026-42946

A remote, anonymous attacker can exploit multiple vulnerabilities in NGINX Open Source and NGINX Plus to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.

CSIRTS triage

vendor: NGINX product: NGINX Open Source and NGINX Plus Authentication bypass Remote code execution Information disclosure Denial of service

What: A remote, anonymous attacker can exploit multiple vulnerabilities in NGINX Open Source and NGINX Plus to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.
Who is affected: Deployments of NGINX Open Source and NGINX Plus.
Urgency: Remediation is high urgency due to the multiple severe vulnerabilities present.
Action: Update to the latest version immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch NGINX Open Source and NGINX Plus

Get an email when a new NGINX Open Source and NGINX Plus advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1527

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2026-42945EPSS puts this in the most-targeted tier (61.5% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99% of all scored CVEs.
Low exploitation riskCVE-2026-404600.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
Low exploitation riskCVE-2026-407010.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
Low exploitation riskCVE-2026-429260.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
Low exploitation riskCVE-2026-429340.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.
Low exploitation riskCVE-2026-429460.93% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 56% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-42945	coverage & exploitation status	NVD · CVE.org
CVE-2026-40460	coverage & exploitation status	NVD · CVE.org
CVE-2026-40701	coverage & exploitation status	NVD · CVE.org
CVE-2026-42926	coverage & exploitation status	NVD · CVE.org
CVE-2026-42934	coverage & exploitation status	NVD · CVE.org
CVE-2026-42946	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalHitachi Energy e-mesh EMScisa

Recent advisories for NGINX Open Source

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-52761: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache…nvd · 2026-07-10
highCVE-2026-52747: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache…nvd · 2026-07-10
high[UPDATE] [high] NGINX Open Source and NGINX Plus: Vulnerability allows denial of service and potentially code …cert-bund · 2026-07-10