CVE-2026-42406: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

CVE-2026-42406 is a privilege misuse vulnerability in F5 BIG-IP and BIG-IQ systems that allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects and execute arbitrary commands. It was published on May 13, 2026, and affects BIG-IP versions 17.1.0 < 17.1.3.2, 17.5.0 < 17.5.1.6, 21.0.0 < 21.0.0.2, and BIG-IP 16.1.0 and BIG-IQ 8.4.0 branches (EoTS versions are not evaluated). The vulnerability carries a CVSS v3.1 score of 8.7 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, F5 Advisory).

The root cause is classified as CWE-267 (Privilege Defined With Unsafe Actions), where the Certificate Manager role is granted capabilities that inadvertently permit modification of configuration objects in ways that enable arbitrary command execution. An authenticated attacker operating over the network can leverage this role to alter BIG-IP or BIG-IQ configuration objects — such as SSL certificate or key management settings — to inject and run arbitrary commands on the underlying system. No user interaction is required beyond the attacker possessing valid credentials with at least Certificate Manager privileges. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, F5 Advisory).

Successful exploitation results in high confidentiality and integrity impact on the vulnerable system, as an attacker can execute arbitrary commands to read sensitive data and modify system state. Availability is not directly impacted according to the CVSS scoring. Because BIG-IP and BIG-IQ are network infrastructure appliances often positioned at critical network boundaries, compromise could expose sensitive traffic, cryptographic material, and configuration data, and may facilitate lateral movement within the managed network environment (GitHub Advisory, F5 Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.027–0.036%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with at least the Certificate Manager role, which significantly limits the attacker pool.

F5 has released patched versions addressing this vulnerability: BIG-IP 17.1.3.2, 17.5.1.6, and 21.0.0.2. BIG-IP 16.1.x and BIG-IQ 8.4.x branches appear to remain unpatched per available version data, and administrators should consult the F5 advisory for branch-specific guidance. As interim mitigations, organizations should restrict the Certificate Manager role to only fully trusted administrators, implement network segmentation to limit access to BIG-IP and BIG-IQ management interfaces, and monitor configuration change logs for unauthorized modifications (F5 Advisory, GitHub Advisory).

The vulnerability received coverage from The Hacker Wire shortly after disclosure, which reported on the arbitrary command execution capability via configuration modification (GitHub Advisory). Tenable added detection support via Nessus plugin 316101. No significant broader community debate or notable researcher commentary has been identified beyond standard vulnerability tracking and aggregation activity.