NGINX Plus and NGINX Vulnerabilities

CERT-Bund has released a security advisory (WID-SEC-2026-0860) detailing critical vulnerabilities affecting NGINX and NGINX Plus web server software. The advisory highlights a CVSS base score of 8.2, indicating a high severity. The vulnerabilities impact versions of NGINX Plus prior to R36 P3, R35 P2, and R32 P5, as well as NGINX versions prior to 1.29.7 and 1.28.3, across Linux, UNIX, and Windows operating systems.

Exploitation of these vulnerabilities could allow a remote attacker to perform a denial-of-service attack, manipulate data, bypass security controls, and potentially execute arbitrary code. Organizations using affected versions of NGINX or NGINX Plus should consult the advisory for specific mitigation strategies and apply available patches or updates to prevent potential security breaches. The advisory notes that mitigation is available, implying that patching or configuration changes can address the risks.