CVE-2026-60062 F5 CVE debrief

Who should care

NGINX Agent and Instance Manager administrators, security teams, and IT professionals responsible for NGINX configurations and security, as well as those managing systems that interact with NGINX Agent, should be aware of this vulnerability. They should review and restrict the use of the config_dirs directive, ensure configurations are secure and up-to-date, and monitor for potential exploits. This includes teams handling vulnerability management, incident response, and system security posture assessments. Additionally, operators and platform administrators may need to assess and mitigate risks associated with this vulnerability in their environments. Security teams should prioritize this based on the CVSS score of 5.3 and potential impact on sensitive directories and files access. Compensating controls and regular reviews of NGINX Agent and Instance Manager software versions are crucial for maintaining security posture. IT professionals should also focus on monitoring and restricting access to sensitive directories and files to limit potential damage from successful exploits. Regular updates and reviews of configurations will help in mitigating the risk associated with this vulnerability. The vulnerability's impact on different user groups necessitates a coordinated approach to ensure comprehensive mitigation and response strategies are implemented effectively across the organization. This involves not only technical teams but also management and compliance functions to ensure that security practices align with organizational policies and regulatory requirements. By taking a holistic approach, organizations can better protect their assets and minimize the risk of exploitation. Therefore, it is essential for all relevant stakeholders to be informed and involved in the mitigation process to ensure the security and integrity of their systems and data. This includes conducting thorough risk assessments, implementing appropriate security measures, and continuously monitoring the environment for signs of potential exploitation. Effective communication and collaboration among different teams and stakeholders are critical to successfully addressing the challenges posed

Technical summary

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The vulnerability can be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary. Impact includes potential limited access outside of secure directories. Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for limited read and write access outside of designated secure directories.

Recommended defensive actions

• Review and restrict the use of the config_dirs directive in NGINX Agent configurations.
• Ensure NGINX Instance Manager configurations are secure and up-to-date.
• Monitor for and restrict access to sensitive directories and files.
• Implement compensating controls to limit potential damage from successful exploits.
• Regularly review and update NGINX Agent and Instance Manager software to the latest versions.

Evidence notes

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. Evidence is based on official CVE and NVD records, with limited additional detail.

Official resources