Is there a patch available for CVE-2026-24464?

Yes, a patch is available for CVE-2026-24464. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-24464

Q: What is the CVSS score of CVE-2026-24464?

CVE-2026-24464 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-29958 MEDIUM

Path Traversal: '.../...//' (CWE-35)

2026-05-13 f5

GHSA-852f-jj8m-xpxf

Path Traversal Big Ip

6.9

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

6.8 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:58 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.8

DescriptionCVE.org

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Directory traversal vulnerability in F5 BIG-IP iControl REST endpoint when running in Appliance mode allows authenticated administrators to delete arbitrary files, crossing security boundaries. The vulnerability requires high-privilege administrator role access and network connectivity to the iControl REST interface, but no user interaction. Patch availability confirmed from F5; no active exploitation reported.

Technical ContextAI

The vulnerability exists in an undisclosed iControl REST endpoint-the primary management interface for F5 BIG-IP appliances. It is a path traversal flaw (CWE-35) that permits directory traversal sequences in file path parameters, enabling an attacker to escape the intended file directory and access the filesystem hierarchy. This occurs specifically when BIG-IP is deployed in Appliance mode, a managed security appliance configuration. The iControl REST API is network-accessible, but exploitation requires prior authentication and administrator-level privileges, limiting the attack surface to trusted internal administrators or accounts compromised at the admin tier.

RemediationAI

Apply the vendor-released patch from F5 advisory K000160911 (https://my.f5.com/manage/s/article/K000160911). Exact patched version numbers are not specified in available data; consult the F5 advisory for supported version upgrade paths. As interim compensating controls: (1) Restrict network access to the iControl REST endpoint to trusted administrative networks using firewall rules or F5 management port restrictions-blocks remote exploitation but impacts legitimate remote administration; (2) Audit and minimize the number of accounts with administrator role privileges-reduces insider attack surface but may impact operational flexibility; (3) Enable comprehensive audit logging of all iControl REST API calls and file operations-detects exploitation post-fact but does not prevent it. Prioritize patching as the primary remediation.