NGINX Management Suite vulnerability
Priority LOW 30CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed NGINX Instance Manager (F5): 2.9.0NGINX API Connectivity Manager (F5): 1.5.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| F5 | NGINX Instance Manager | 2.0.0 to before 2.9.0; 1.0.0 and later | 2.9.0 | Patch available | CNA |
| F5 | NGINX API Connectivity Manager | 1.0.0 to before 1.5.0 | 1.5.0 | Patch available | CNA |
| F5 | NGINX Security Monitoring | 1.0.0 to before 1.3.0 | 1.3.0 | Patch available | CNA |
- NGINX Instance Manager VendorF5 Affected 2.0.0 to before 2.9.0; 1.0.0 and later Fixed in 2.9.0 Patch available CNA
- NGINX API Connectivity Manager VendorF5 Affected 1.0.0 to before 1.5.0 Fixed in 1.5.0 Patch available CNA
- NGINX Security Monitoring VendorF5 Affected 1.0.0 to before 1.3.0 Fixed in 1.3.0 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:nginx_api_connectivity_manager:*:*:*:*:*:*:*:* | 1.0.0 to before 1.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* | 2.0.0 to before 2.9.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_security_monitoring:*:*:*:*:*:*:*:* | 1.0.0 to before 1.3.0 | Vulnerable | F5 |
- cpe:2.3:a:f5:nginx_api_connectivity_manager:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.9.0 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_security_monitoring:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.3.0 Vulnerable ·F5
Remediation
- Fix · CNA NGINX Instance Manager (F5) Fixed in 2.9.0
- Fix · CNA NGINX API Connectivity Manager (F5) Fixed in 1.5.0
- Fix · CNA NGINX Security Monitoring (F5) Fixed in 1.3.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
F5 NGINX API Connectivity Manager, NGINX Instance Manager, NGINX Security Monitoring 1.3.0, 1.5.0, 2.9.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-13174 NGINX Management Suite vulnerabilityPriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28724
- 2026-10-03 Alias added: GHSA-9mcp-v29j-j4hp
References
More F5 Nginx Api Connectivity Manager vulnerabilities
- TI-2023-13174 NGINX Management Suite vulnerability CVSS 3.1HIGH 8.1
- TI-2024-09559 NGINX OpenID Connect Vulnerability CVSS 4.0MEDIUM 5.1
Sources
- CVE-2023-28724 · CVE Program
- CVE-2023-28724 · NVD
- FIRST EPSS
- GHSA-9mcp-v29j-j4hp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences