Exploit for Incorrect Authorization in F5 Nginx_Plus CVE-2026-28755 CVE-2026-42055 CVE-2026-42533 CVE-2026-42926 CVE-2026-9256

Name: Exploit for Incorrect Authorization in F5 Nginx_Plus CVE-2026-28755 CVE-2026-42055 CVE-2026-42533 CVE-2026-42926 CVE-2026-9256
Rating: 5 (4 reviews)
2026-07-28 | CVSS 9.2
## https://sploitus.com/exploit?id=55A2FAF2-9583-513B-A7DC-8A6DC7AAB473
# 🛡️ NGINX 2026 Multi-CVE CTI Investigation

### CVE-2026-28755 • CVE-2026-42926 • CVE-2026-9256 • CVE-2026-42055 • CVE-2026-42533

![Vendor](https://img.shields.io/badge/Vendor-F5%20%2F%20NGINX-blue?style=for-the-badge)
![Product](https://img.shields.io/badge/Product-NGINX%20Open%20Source%20%2F%20Plus-cyan?style=for-the-badge)
![Highest Severity](https://img.shields.io/badge/Highest%20Severity-Critical-red?style=for-the-badge)
![KEV](https://img.shields.io/badge/CISA%20KEV-Not%20Found-lightgrey?style=for-the-badge)
![Focus](https://img.shields.io/badge/Focus-Data%20Plane%20Exposure-orange?style=for-the-badge)

**Created by Pratik Chhetri**  
**Report Date:** 2026-07-28



---

## 📌 Executive Snapshot

| CVE | Component | Primary Issue | Fixed Open Source Versions | Priority |
|---|---|---|---|---:|
| **CVE-2026-28755** | `ngx_stream_ssl_module` | OCSP result bypass in stream mTLS | 1.29.7+, 1.28.3+ | P3 / P2 |
| **CVE-2026-42926** | `ngx_http_proxy_v2_module` | HTTP/2 upstream request injection | 1.31.0+, 1.30.1+ | P2 |
| **CVE-2026-9256** | `ngx_http_rewrite_module` | Heap overflow via overlapping PCRE captures | 1.31.1+, 1.30.2+ | P1 |
| **CVE-2026-42055** | `ngx_http_proxy_v2_module`, `ngx_http_grpc_module` | Heap overflow with HTTP/2/gRPC large headers | 1.31.2+, 1.30.3+ | P1 |
| **CVE-2026-42533** | `map` directive with regex matching | Heap overflow via regex map capture clobbering | 1.31.3+, 1.30.4+ | P0/P1 |

---

## 🚨 Key Message

These five vulnerabilities are **configuration-dependent NGINX data-plane risks**.

Risk is highest for:

- Internet-facing reverse proxies
- API gateways
- NGINX Ingress Controller deployments
- gRPC gateways
- HTTP/2 upstream proxying
- Regex-heavy `rewrite` and `map` configurations
- Stream mTLS deployments using OCSP validation

> Patch first, then audit configuration exposure.

---

## 🧭 Attack Path Overview

```mermaid
flowchart TD
    A[Remote requester] --> B[Internet-facing NGINX data plane]
    B --> C{Vulnerable configuration present?}
    C -->|stream mTLS + OCSP| D1[CVE-2026-28755]
    C -->|proxy_http_version 2 + proxy_set_body| D2[CVE-2026-42926]
    C -->|rewrite overlapping captures| D3[CVE-2026-9256]
    C -->|gRPC / HTTP2 + large headers| D4[CVE-2026-42055]
    C -->|regex map capture ordering| D5[CVE-2026-42533]
    D1 --> E1[Revoked cert may be accepted]
    D2 --> E2[Upstream HTTP/2 frame injection]
    D3 --> E3[Worker crash or possible code execution]
    D4 --> E3
    D5 --> E3
```

---

## 🔥 Threat Intelligence Summary

| Item | Result |
|---|---|
| CISA KEV | Not Found for all five CVEs |
| Active exploitation | Not Found in reviewed public sources |
| Ransomware usage | Not Found |
| APT attribution | Not Found |
| Exploit-DB | Not Found |
| Metasploit | Not Found |
| Public GitHub activity | Found for CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533 |
| Public scanner | Found for CVE-2026-42533 |
| Highest EPSS | CVE-2026-9256 at 0.098840 |

---

## 🕒 Disclosure and Patch Timeline

```mermaid
timeline
    title NGINX 2026 CVE Timeline
    2026-03-24 : CVE-2026-28755 fixed in nginx 1.28.3 / 1.29.7
    2026-05-13 : CVE-2026-42926 fixed in nginx 1.30.1 / 1.31.0
    2026-05-22 : CVE-2026-9256 fixed in nginx 1.30.2 / 1.31.1
    2026-06-17 : CVE-2026-42055 fixed in nginx 1.30.3 / 1.31.2
    2026-07-15 : CVE-2026-42533 fixed in nginx 1.30.4 / 1.31.3
    2026-07-28 : CTI package finalized
```

---

## 🛠️ Configuration Exposure Checklist

Search NGINX configuration for these directives and patterns:

```text
ssl_verify_client on
ssl_ocsp on
proxy_http_version 2
proxy_set_body
grpc_pass
ignore_invalid_headers off
large_client_header_buffers
rewrite
map
regex captures: $1 $2 $3 ...
```

High-risk combinations:

| CVE | High-risk configuration |
|---|---|
| CVE-2026-28755 | `ssl_verify_client on` + `ssl_ocsp on` in stream TLS client-auth deployments |
| CVE-2026-42926 | `proxy_http_version 2` + `proxy_set_body` |
| CVE-2026-9256 | `rewrite` regex with distinct overlapping PCRE captures and replacement referencing multiple captures |
| CVE-2026-42055 | `grpc_pass` or `proxy_http_version 2` + `ignore_invalid_headers off` + `large_client_header_buffers` above 2 MB |
| CVE-2026-42533 | regex `map` and string expressions referencing regex capture variables in vulnerable order |

---

## 🔎 Detection Ideas

### Runtime Signals

```text
nginx worker process exited
exited on signal
segfault
core dumped
CrashLoopBackOff
unexpected 5xx spike
```

### Suspicious Process Behavior

```text
nginx worker process -> sh / bash / curl / wget / nc / ncat / powershell
```

### Network and HTTP Signals

```text
Large HTTP/2 headers
Unexpected gRPC upstream failures
Upstream request desynchronization
TLS client certificate accepted despite OCSP revoked status
```

---

## 📊 Risk Matrix

| Environment | Risk | Priority | Action |
|---|---:|---:|---|
| Internet-facing NGINX with regex map exposure | Critical | P0/P1 | Upgrade to 1.30.4 / 1.31.3 or fixed Plus release |
| Internet-facing NGINX with HTTP/2/gRPC large-header exposure | High | P1 | Patch and remove unsafe header config |
| NGINX rewrite rules with overlapping captures | High | P1 | Patch and rewrite vulnerable regex patterns |
| HTTP/2 upstream proxying with `proxy_set_body` | Medium | P2 | Patch or change HTTP upstream version |
| Stream mTLS with OCSP revocation checks | Medium | P2/P3 | Patch and validate revoked cert behavior |
| NGINX not internet-facing and no vulnerable directives | Low-Medium | P3 | Patch in normal cycle and monitor |

---

## ✅ Verified Indicator Status

| Indicator Type | Status |
|---|---|
| Attacker IPs | Not Found |
| Attacker domains | Not Found |
| Malicious URLs | Not Found |
| Malware hashes | Not Found |
| Registry keys | Not Found |
| Mutexes | Not Found |
| Verified scanner filename | `nginx_capture_clobber_scan.py` for CVE-2026-42533 |
| Key process | `nginx`, `nginx: worker process` |
| Key config files | `nginx.conf`, files under `conf.d/`, stream/http server blocks |

---

## 📚 Full Report

The complete enterprise CTI report is available here:

➡️ **[`NGINX_2026_CVE_CTI_Report.md`](./NGINX_2026_CVE_CTI_Report.md)**

It includes:

- Official CVE identification
- CVSS, EPSS, KEV status
- Technical analysis
- CPE and affected product validation
- Exploit maturity assessment
- Threat actor likelihood analysis
- IOC table
- MITRE ATT&CK mapping
- ATT&CK data sources
- Detection coverage matrix
- Sigma ideas with validation status
- Wazuh guidance
- Splunk SPL
- Microsoft Sentinel KQL
- Snort/Suricata concepts
- ATT&CK Navigator layer snippet
- STIX 2.1 export snippet
- MISP event export snippet
- Evidence provenance table
- Intelligence gaps
- Assumptions and limitations

---

## 🔗 Primary References

- nginx security advisories: https://nginx.org/en/security_advisories.html
- nginx 2026 news: https://nginx.org/2026.html
- F5 CVE-2026-42926 advisory: https://my.f5.com/manage/s/article/K000161131
- F5 CVE-2026-42055 advisory: https://my.f5.com/manage/s/article/K000161584
- F5 CVE-2026-42533 advisory: https://my.f5.com/manage/s/article/K000162097
- CVE Services API: https://cveawg.mitre.org/api/cve/
- FIRST EPSS API: https://api.first.org/data/v1/epss
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CVE-2026-42533 static scanner: https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner

---



**Patch NGINX. Audit directives. Watch worker crashes. Treat edge proxies as critical infrastructure.**