7.1

CVE-2026-40462

iControl REST and tmsh vulnerability

Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Access Policy Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Analytics Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Analytics Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Security Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Security Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Application Visibility And Reporting Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Application Visibility And Reporting Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Automation Toolchain Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Automation Toolchain Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Carrier-grade Nat Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Carrier-grade Nat Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Container Ingress Services Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Container Ingress Services Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Domain Name System Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Domain Name System Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Edge Gateway Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Edge Gateway Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Fraud Protection Service Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Fraud Protection Service Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Global Traffic Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Global Traffic Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Link Controller Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Link Controller Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Local Traffic Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Webaccelerator Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Webaccelerator Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Websafe Version >= 17.1.0 <= 17.1.3
F5 ≫ Big-ip Websafe Version >= 17.5.0 <= 17.5.1
F5 ≫ Big-ip Access Policy Manager Version 21.0.0
F5 ≫ Big-ip Analytics Version 21.0.0
F5 ≫ Big-ip Automation Toolchain Version 21.0.0
F5 ≫ Big-ip Carrier-grade Nat Version 21.0.0
F5 ≫ Big-ip Ddos Hybrid Defender Version 21.0.0
F5 ≫ Big-ip Domain Name System Version 21.0.0
F5 ≫ Big-ip Edge Gateway Version 21.0.0
F5 ≫ Big-ip Fraud Protection Service Version 21.0.0
F5 ≫ Big-ip Global Traffic Manager Version 21.0.0
F5 ≫ Big-ip Link Controller Version 21.0.0
F5 ≫ Big-ip Local Traffic Manager Version 21.0.0
F5 ≫ Big-ip Ssl Orchestrator Version 21.0.0
F5 ≫ Big-ip Webaccelerator Version 21.0.0
F5 ≫ Big-ip Websafe Version 21.0.0
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Analytics Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Application Visibility And Reporting Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Automation Toolchain Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Carrier-grade Nat Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Container Ingress Services Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Edge Gateway Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Link Controller Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Webaccelerator Version >= 16.1.0 <= 16.1.6
F5 ≫ Big-ip Websafe Version >= 16.1.0 <= 16.1.6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.158
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
F5 7.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
F5 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://my.f5.com/manage/s/article/K000156581
Vendor Advisory
Mitigation