F5 Nginx Agent vulnerabilities

3 CVEs affecting F5 Nginx Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60062, published 2026-07-15.

More from F5.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-7634, published 2024-08-22. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
• CVE-2026-60062, published 2026-07-15. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The config_dirs directive required…
• CVE-2023-1550, published 2023-03-29. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with…