[UPDATE] [high] NGINX Open Source and NGINX Plus: Multiple vulnerabilities

highCVE-2026-42945 CVE-2026-40460 CVE-2026-40701 CVE-2026-42926 CVE-2026-42934 CVE-2026-42946

A remote, anonymous attacker can exploit multiple vulnerabilities in NGINX Open Source and NGINX Plus to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.

CSIRTS triage

vendor: NGINX product: NGINX Open Source and NGINX Plus Authentication bypass Remote code execution Information disclosure Denial of service

What: A remote, anonymous attacker can exploit multiple vulnerabilities in NGINX Open Source and NGINX Plus to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.
Who is affected: Deployments of NGINX Open Source and NGINX Plus.
Urgency: Remediation is high urgency due to the multiple severe vulnerabilities present.
Action: Update to the latest version immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch NGINX Open Source and NGINX Plus

Get an email when a new NGINX Open Source and NGINX Plus advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-25
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1527

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2026-42945EPSS puts this in the most-targeted tier (66.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99.2% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-404600.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-407010.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-429260.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-429340.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-429460.93% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 58% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-42945	coverage & exploitation status	NVD · CVE.org
CVE-2026-40460	coverage & exploitation status	NVD · CVE.org
CVE-2026-40701	coverage & exploitation status	NVD · CVE.org
CVE-2026-42926	coverage & exploitation status	NVD · CVE.org
CVE-2026-42934	coverage & exploitation status	NVD · CVE.org
CVE-2026-42946	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
unknownMultiple vulnerabilities in SAP products (August 11, 2026)cert-fr-avis
criticalHitachi Energy e-mesh EMScisa

Recent advisories for NGINX Open Source

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[UPDATE] [high] NGINX Open Source and NGINX Plus: Vulnerability allows denial of service and potentially code …cert-bund · 2026-08-25
highCVE-2026-60005: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. Whe…nvd · 2026-07-15
mediumCVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This …nvd · 2026-07-15
highCVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex mat…nvd · 2026-07-15
mediumCVE-2026-52761: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache…nvd · 2026-07-10
highCVE-2026-52747: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache…nvd · 2026-07-10