NGINX
CVE-2024-7634: NGINX Agent Vulnerability
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 4.0 6.9
EPSS0.47%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| NGINX Agent 2.17 | 2.37.0 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.