CVE-2026-60065

Assessment

Why it matters

EPSS is 0.3%; technical severity is CVSS 6.3.

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Who should care

• Teams operating Nginx Gateway Fabric, Nginx Ingress Controller, Nginx Plus +1 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Nginx Gateway Fabric, Nginx Ingress Controller, Nginx Plus +1 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. F5 Security advisory K000162101
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-125

Affected versions

F5 Nginx Gateway Fabric (Start Including 1.3.0, End Including 1.6.2 | Start Including 2.0.0, End Excluding 2.6.7); F5 Nginx Ingress Controller (Start Including 3.5.0, End Including 3.7.2 | Start Including 5.0.0, End Excluding 5.5.3 | Start Including 2026-lts-r1, End Excluding 2026-lts-r4 | Version 4.0.0); F5 Nginx Plus (Start Including 37.0.0.1, End Excluding 37.0.3.1 | Start Including r33, End Excluding r36 | Version r36 | Version r36); F5 Waf (Start Including 4.11.0, End Including 4.16.0 | Start Including 5.2.0, End Including 5.8.0 | Start Including 5.9.0, End Excluding 5.13.4)

Fixed versions

F5 Nginx Gateway Fabric (Fixed from 2.6.7); F5 Nginx Ingress Controller (Fixed from 5.5.3, 2026-lts-r4); F5 Nginx Plus (Fixed from 37.0.3.1, r36); F5 Waf (Fixed from 5.13.4)

Published

15 July 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 15 Jul 2026CVE published
2. 21 Aug 2026Latest EPSS score: 0.3%
3. 19 Aug 2026 · 13:54 UTCSignal calculated at 10