According to VulnCheck, a newly disclosed security flaw affecting NGINX Plus and NGINX Open has become actively exploited just days after its public disclosure.
The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), has a heap buffer overflow in the ngx_http_rewrite_module that affects NGINX versions 0.6.27 to 1.30.0. According to AI-native security company DepthFirst, the vulnerability was introduced in 2008.
Successful exploitation of the flaw could allow an unauthenticated attacker to crash worker processes or execute remote code with crafted HTTP requests. However, it is worth noting that code execution is only possible on devices where Address Space Layout Randomization (ASLR), a security measure against memory-based attacks, is turned off.
“It depends on a specific NGINX configuration to be vulnerable, and an attacker has to know or discover the configuration to exploit it,” said security researcher Kevin Beaumont. “To reach RCE [remote code execution]ASLR also needs to be disabled on the box.”
In a similar assessment, AlmaLinux maintainers stated: “Turning heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect it to be easy to produce a generic, reliable exploit.”
“That said, ‘not easy’ is not ‘impossible,’ and employee-incident DoS is so exploitable in itself that we recommend treating it as a matter of urgency,” the maintainers said.
Vulncheck’s latest findings show that threat actors have begun to weaponize the flaw, with exploit attempts detected against its honeypot networks. The nature of the attack activity and the ultimate goal are currently unknown. Users are advised to apply the latest fixes from F5 to secure their networks against active threats.
Flaws in OpenDCIM were also exploited
The development comes as VulnCheck also revealed exploit attempts targeting two critical flaws in OpenDCIM, an open-source application used for data center infrastructure management. The vulnerabilities, both rated 9.3 on the CVSS scoring system, are listed below –
- CVE-2026-28515 – A missing authorization vulnerability that could allow an authenticated user to access FTP configuration functionality regardless of their assigned privileges. In Docker deployments where REMOTE_USER is set without authentication enforcement, the endpoint may become accessible without credentials, allowing unauthorized modification of the application configuration.
- CVE-2026-28517 – An operating system command injection vulnerability affecting the “report_network_map.php” component that processes a parameter named “dot” unsanitized and passes it directly to a shell command, resulting in arbitrary code execution.
Two vulnerabilities were discovered in February 2026 by VulnCheck security researcher Valentin Lobstein in OpenDCIM, along with an SQL injection vulnerability, CVE-2026-28516 (CVSS score: 9.3). According to Lobstein, the three flaws can be combined to achieve remote code execution on five HTTP requests and generate a reverse shell.
“The cluster of attack activity we’re seeing so far originates from a single Chinese IP and uses a customized implementation of the AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before they leave the PHP web shell,” said Caitlin Condon, vice president of security research at VulnCheck.
