Is CVE-2026-60062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60062 being exploited in the wild.

How severe is CVE-2026-60062?

Medium severity, with a CVSS score of 6.4, published 15 July 2026.

Which products and versions are affected?

F5 NGINX Agent 2.0.0 to 2.46.0; F5 NGINX Instance Manager 2.17.1 to 2.22.1.

Is there a fix for CVE-2026-60062?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-60062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-60062?

Check whether you run F5 NGINX Agent or F5 NGINX Instance Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60062: F5 NGINX Agent path traversal in config_dirs directive

CVE-2026-60062 · Severity: medium · CVSS 6.4 · Published 2026-07-15

NGINX Agent and Instance Manager are tools used to manage and monitor NGINX web server instances. A vulnerability in how these tools handle directory configurations allows a user with low-level access to read or write files outside of their authorized folders. This could lead to the exposure of sensitive configuration data or unauthorized modification of system files, potentially compromising the integrity of the managed web servers.

Technologies: F5 NGINX Instance Manager. Vendors: F5.

Quick answers

Is CVE-2026-60062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60062 being exploited in the wild.
How severe is CVE-2026-60062?: Medium severity, with a CVSS score of 6.4, published 15 July 2026.
Which products and versions are affected?: F5 NGINX Agent 2.0.0 to 2.46.0; F5 NGINX Instance Manager 2.17.1 to 2.22.1.
Is there a fix for CVE-2026-60062?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-60062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-60062?: Check whether you run F5 NGINX Agent or F5 NGINX Instance Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the NGINX Agent 'config_dirs' directive, which can also be configured via NGINX Instance Manager. The flaw allows a remotely authenticated attacker with low privileges to bypass directory restrictions and perform limited read/write operations on files outside the intended secure scope. This occurs because the application fails to properly sanitize or validate the directory paths specified in the configuration. The vulnerability is confirmed in NGINX Agent versions 2.x prior to 2.47.0 and NGINX Instance Manager versions 2.17.1 through 2.22.1. Users are advised to upgrade to NGINX Agent 2.47.0 or 3.0.0, and NGINX Instance Manager 2.22.2 or later.

Affected products

F5 NGINX Agent 2.0.0 to 2.46.0
F5 NGINX Instance Manager 2.17.1 to 2.22.1

Timeline

2026-07-15: advisory: F5 published security advisory K000161971
2026-07-15: disclosed: CVE-2026-60062 published to NVD

References

https://my.f5.com/manage/s/article/K000161971

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.