CVE-2026-97629

mediumPriorität · verfolgen · 36EPSS 0.002 · 14. PerzentilExploit · PoCDEFRUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.23% (14th) EPSS

CVSS 6.5 · medium

Is it mine?

22 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

osv · cert_bund · certfr

EPSS · bewertet 2026-10-27

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.5–8.3

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:Nprimary · f5sirt@f5.comAusnutzbarkeit 2.2 · Auswirkung 4.2

v4.08.3highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · f5sirt@f5.com

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-908US

Exploits (2)

Öffentlicher Proof-of-Concept- und Exploit-Code.

betroffene Produkte (22)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
NGINX NGINX App Protect WAFalle Versionencert_bundDEcpe:/a:nginx:nginx:app_protect_waf
NGINX NGINX NGINX App Protect DoSalle Versionencert_bundDEcpe:/a:nginx:nginx:nginx_app_protect_dos
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
NGINX NGINX Plus< 37.0.5.1cert_bundDE
NGINX NGINX Plus< 37.0.7.1cert_bundDE
NGINX NGINX Plus< 37.1.0.1cert_bundDE
NGINX NGINX Plus< 37.2.0.1cert_bundDE
Nginx Nginx≤ Open Source <1.31.7cert_bundDE
Nginx Nginx≤ F5 DoS <4.11.0cert_bundDE
Nginx Nginx≤ F5 WAF <5.14.2cert_bundDE
Nginx Nginx≤ F5 WAF <5.16.0cert_bundDE
Nginx Nginx≤ Gateway Fabric <2.8.0cert_bundDE
Nginx Nginx≤ Ingress Controller <5.7.0cert_bundDE
Nginx Nginx≤ Instance Manager <2.24.0cert_bundDE
Nginx Nginx≤ JavaScript (njs) <1.0.2cert_bundDE
Nginx Nginx≤ Open Source <1.30.6cert_bundDE
Bitnami nginx0.1.29 → 1.30.6osvUSpkg:bitnami/nginx

20 von 22 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-3948NGINX: Mehrere SchwachstellenDeutsch2026-10-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in NGINX NGINX Plus und NGINX ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
BIT-nginx-2026-97629NGINX ngx_http_ssl_module vulnerability2026-10-21vendor · osvUS
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
BIT-nginx-gateway-2026-97629NGINX ngx_http_ssl_module vulnerability2026-10-21vendor · osvUS
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CERTFR-2026-AVI-1317Multiples vulnérabilités dans les produits F5Français2026-10-15vendor · certfrFR
CERTFR-2026-AVI-1341Multiples vulnérabilités dans les produits F5Français2026-10-19vendor · certfrFR

auch bekannt als (2)

Weitere Namen und Kennungen dieser Entität.

BIT-nginx-2026-97629osv
BIT-nginx-gateway-2026-97629osv

quellen

Welche Quellen diesen Datensatz belegen und wann.

osv cert_bund certfr NVD CVE.org MITRE

veröffentlicht 2026-10-14geändert 2026-10-15

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://my.f5.com/manage/s/article/K000162606

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan