Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

1 IOC

CVE-2026-42945: 18-Year-Old NGINX Rewrite Flaw May Enable Unauthenticated RCE

SOC Prime

Published May 14, 2026Original Report

Excerpt

Web infrastructure bugs remain especially dangerous when they sit in widely deployed request-handling logic for years without detection. Among the latest vulnerabilities impacting NGINX Plus and NGINX Open, the CVE-2026-42945 vulnerability stands out as an 18-year-old heap buffer overflow in ngx_http_rewrite_module that can be reached by an unauthenticated attacker through crafted HTTP requests and may lead to denial of service or, in some cases, remote code execution. Public…

Read the original report →

Attack Flow4 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1190

1/4

Exploit Public-Facing Application

ActionExploit NGINX rewrite vulnerability

An unauthenticated attacker sends crafted HTTP requests to exploit a heap buffer overflow in the NGINX rewrite module.

Indicators of Compromise

Open the mindmap →

1 indicators

Type	Indicator	Confidence	Score	First Seen
CVE	CVE-2026-42945	High	Score 59/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…