NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 6h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 11h EU Grocers Pay a Steep Price for Unpatched Fridge Firmware · 11h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 6h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 11h EU Grocers Pay a Steep Price for Unpatched Fridge Firmware · 11h

ACyber Sentinel Security Assessment Team

← Back to feed

⚠️ Vulnerability Report

CVE-2026-97629

HIGH CVSS 8.3 CVSS 4.0 📌 Awaiting Analysis

CVE-2026-97629 - NGINX ngx_http_ssl_module vulnerability

Description

When NGINX Plus or NGINX Open Source is configured with ssl_session_cache

shared:name:size

without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions

in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.

Impact

This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published: Oct 14, 2026 15:17

Last Modified: Oct 14, 2026 16:04