F5-K000161971: Medium severity F5 NGINX Agent vulnerability

Q: What level of access does an attacker need to exploit this issue?

The issue requires a low-privileged attacker. No user interaction is required.

Q: Which deployments should be reviewed for exposure?

Review F5 NGINX Agent configurations that use the config_dirs directive. Also review configurations managed through F5 NGINX Instance Manager, because the directive can be configured through Instance Manager.

Q: What access could exploitation provide?

A successful exploit may provide limited read and write access to files outside the designated secure directory, allowing an attacker to cross a security boundary.

Published Jul 15, 2026

Updated

The NGINX Agent configdirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The configdirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary.

Affected Software

3 affected componentsFixes available

F5 NGINX Agent

F5 NGINX Agent>=2.37.0<=2.46.6

2.46.7

F5 NGINX Instance Manager>=2.17.1<=2.22.1

2.22.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.46.7
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.22.2

Event History

Jul 15, 2026

Advisory Published

via F5·01:42 PM

Data Sourced

via F5·01:42 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue requires a low-privileged attacker. No user interaction is required.

Which deployments should be reviewed for exposure?

Review F5 NGINX Agent configurations that use the config_dirs directive. Also review configurations managed through F5 NGINX Instance Manager, because the directive can be configured through Instance Manager.

What access could exploitation provide?

A successful exploit may provide limited read and write access to files outside the designated secure directory, allowing an attacker to cross a security boundary.

F5-K000161971: Medium severity F5 NGINX Agent vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be reviewed for exposure?

What access could exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be reviewed for exposure?

What access could exploitation provide?