NGINX Agent CVE-2026-60062

A patch is available from F5 per vendor advisory K000161971 (https://my.f5.com/manage/s/article/K000161971); the exact fixed version number was not included in the available input data and should be confirmed directly from that advisory before deploying. As a compensating control prior to patching, operators can restrict which accounts have permission to modify the config_dirs directive - limiting this to only highly trusted administrative roles reduces the low-privileged exploitation path. In environments using NGINX Instance Manager to manage config_dirs centrally, access controls on the Instance Manager API and UI should be reviewed and tightened to the minimum necessary principals. Note that disabling config_dirs entirely may impact legitimate agent functionality; consult F5 documentation before making that change. EoTS versions should be prioritized for version upgrades as no patch will be issued for them.