What’s Vulnerable › Vulnerabilities

CVE-2023-28656: NGINX Management Suite vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-03 · updated 2026-06-17
• Weakness: CWE-639

Description

NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 NGINX API Connectivity Manager: from 1.0.0 before 1.5.0 — fixed in 1.5.0
• F5 NGINX Instance Manager: from 2.0.0 before 2.9.0 — fixed in 2.9.0
• F5 NGINX Security Monitoring: from 1.0.0 before 1.3.0 — fixed in 1.3.0
• NetApp Cloud Backup: all versions
• NetApp Ontap Select Deploy: all versions

How to fix

Upgrade to a fixed version: F5 NGINX API Connectivity Manager 1.5.0; F5 NGINX Instance Manager 2.9.0; F5 NGINX Security Monitoring 1.3.0. Check the vendor advisory for mitigations.

References

• https://my.f5.com/manage/s/article/K000133417
• https://security.netapp.com/advisory/ntap-20230609-0006/
• https://my.f5.com/manage/s/article/K000133417
• https://security.netapp.com/advisory/ntap-20230609-0006/

Get alerted when CVE-2023-28656 or the next vulnerability affects your stack