CVE-2026-60062

Assessment

Why it matters

EPSS is 0.2%; technical severity is CVSS 5.3.

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The config_dirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary. Impact: A remotely authenticated low-privileged attacker could gain limited read and write access outside of the list of directories specified in the NGINX Agent configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Who should care

• Teams operating Nginx Agent, Nginx Instance Manager
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Nginx Agent, Nginx Instance Manager is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. F5 Security advisory K000161971
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-22

Affected versions

F5 Nginx Agent (Start Including 2.37.0, End Excluding 2.46.7); F5 Nginx Instance Manager (Start Including 2.17.1, End Excluding 2.22.2)

Fixed versions

F5 Nginx Agent (Fixed from 2.46.7); F5 Nginx Instance Manager (Fixed from 2.22.2)

Published

15 July 2026

Attack vector

Network

Privileges required

Low

User interaction

None

Signal timeline

1. 15 Jul 2026CVE published
2. 22 Aug 2026Latest EPSS score: 0.2%
3. 19 Aug 2026 · 13:54 UTCSignal calculated at 9