Vulnerability · Published Jul 15, 2026 · Assigned by f5

CVE-2026-60062NGINX Agent Vulnerability

Medium 6.4

In plain English

A medium-severity path traversal in NGINX Agent from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 77.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The config_dirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary. Impact: A remotely authenticated low-privileged attacker could gain limited read and write access outside of the list of directories specified in the NGINX Agent configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Agent	2.0.0 – before 2.47.0
F5	NGINX Instance Manager	2.22.0 – before 2.22.22.17.1 – before *

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://my.f5.com/manage/s/article/K000161971 vendor-advisory, patch