CVE-2026-41954: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

CVE-2026-41954 is a sensitive information disclosure vulnerability affecting F5 BIG-IP and BIG-IQ products via an undisclosed iControl REST endpoint and TMOS Shell (tmsh) command. An authenticated attacker with resource administrator role privileges can exploit this flaw over the network to view sensitive information. Affected versions include BIG-IP 16.1.0 and later (up to fixed releases), BIG-IP 17.1.0 < 17.1.3.1, BIG-IP 17.5.0 < 17.5.1.4, BIG-IP 21.0.0 < 21.0.0.1, and BIG-IQ 8.4.0 < 8.4.1; software versions that have reached End of Technical Support (EoTS) are not evaluated. The vulnerability was published on May 13, 2026, with a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, F5 Advisory).

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from an undisclosed iControl REST API endpoint and a TMOS Shell (tmsh) command that improperly expose sensitive data to authenticated users with resource administrator privileges (GitHub Advisory). The attack vector is network-based, requires no user interaction, and has low attack complexity, but does require high privileges (resource administrator role) to exploit. The specific endpoint and tmsh command involved have not been publicly disclosed by F5, limiting the ability to characterize the precise exploitation mechanics beyond authenticated API or shell access (F5 Advisory).

Successful exploitation allows an authenticated attacker with resource administrator privileges to access sensitive information that should be restricted, resulting in a high confidentiality impact with no effect on integrity or availability. The scope is limited to the vulnerable system itself, with no subsequent system impact identified. While the vulnerability does not enable code execution or system modification, exposure of sensitive configuration or credential data could facilitate further attacks or lateral movement within the environment (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.051% (21st percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Authentication: Obtain valid credentials for an account with the resource administrator role on the target F5 BIG-IP or BIG-IQ system.
2. Access iControl REST or tmsh: Connect to the target system's management interface via HTTPS (iControl REST API) or SSH (TMOS Shell).
3. Query undisclosed endpoint or command: Issue requests to the undisclosed iControl REST endpoint or execute the specific tmsh command that improperly exposes sensitive information. The exact endpoint and command have not been publicly disclosed by F5.
4. Retrieve sensitive data: Parse the API response or tmsh output to extract sensitive information, which may include configuration details, credentials, or other restricted data that could be leveraged for further attacks (GitHub Advisory, F5 Advisory).

• Logs: Unusual or unexpected API calls to iControl REST endpoints by resource administrator accounts, particularly to undisclosed or rarely accessed endpoints; tmsh command history showing execution of sensitive data-retrieval commands by non-privileged-administrator accounts.
• Network: Authenticated HTTPS requests to the BIG-IP/BIG-IQ management interface (typically port 443 or 8443) from unexpected source IPs or at unusual times.
• Process/Audit: F5 audit logs (/var/log/audit) showing resource administrator logins followed by atypical REST API queries or tmsh commands; access from accounts not normally associated with administrative tasks.

F5 has released patched versions addressing this vulnerability: BIG-IP 17.1.3.1, 17.5.1.4, and 21.0.0.1, and BIG-IQ 8.4.1. Organizations should upgrade to these fixed versions as the primary remediation (F5 Advisory). As interim workarounds, restrict access to iControl REST endpoints and TMOS Shell (tmsh) to trusted administrators only, implement network-level access controls (e.g., firewall rules, management network segmentation) to limit who can reach management interfaces, and monitor administrative access for suspicious activity. Software versions that have reached End of Technical Support (EoTS) will not receive patches and should be upgraded to a supported release.