8.6

CVE-2026-39459

iControl REST and tmsh vulnerability

A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Access Policy Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Analytics Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Analytics Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Security Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Security Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Visibility And Reporting Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Visibility And Reporting Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Automation Toolchain Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Automation Toolchain Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Carrier-grade Nat Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Carrier-grade Nat Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Container Ingress Services Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Container Ingress Services Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Domain Name System Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Domain Name System Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Edge Gateway Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Edge Gateway Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Fraud Protection Service Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Fraud Protection Service Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Global Traffic Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Global Traffic Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Link Controller Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Link Controller Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Local Traffic Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Webaccelerator Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Webaccelerator Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Websafe Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Websafe Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Analytics Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Visibility And Reporting Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Automation Toolchain Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Carrier-grade Nat Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Container Ingress Services Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Edge Gateway Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Link Controller Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Webaccelerator Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Websafe Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Access Policy Manager Version 21.0.0
F5 ≫ Big-ip Analytics Version 21.0.0
F5 ≫ Big-ip Automation Toolchain Version 21.0.0
F5 ≫ Big-ip Carrier-grade Nat Version 21.0.0
F5 ≫ Big-ip Ddos Hybrid Defender Version 21.0.0
F5 ≫ Big-ip Domain Name System Version 21.0.0
F5 ≫ Big-ip Edge Gateway Version 21.0.0
F5 ≫ Big-ip Fraud Protection Service Version 21.0.0
F5 ≫ Big-ip Global Traffic Manager Version 21.0.0
F5 ≫ Big-ip Link Controller Version 21.0.0
F5 ≫ Big-ip Local Traffic Manager Version 21.0.0
F5 ≫ Big-ip Ssl Orchestrator Version 21.0.0
F5 ≫ Big-ip Webaccelerator Version 21.0.0
F5 ≫ Big-ip Websafe Version 21.0.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.168
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
F5 8.6 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
F5 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-272 Least Privilege Violation

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

https://my.f5.com/manage/s/article/K000160863
Vendor Advisory
Mitigation