F5 BIG-IP CVE-2026-24464

Exploitation requires: (1) BIG-IP deployed in Appliance mode (non-default deployment configuration); (2) Valid administrator-role account credentials for authentication to iControl REST API; (3) Network connectivity to the iControl REST endpoint (typically internal management network, but AV:N indicates remote reachability). The vulnerability does NOT require user interaction (UI:N) or special client-side conditions. Exploitation is limited to authenticated administrators only-unauthenticated remote exploitation is not possible. End-of-life BIG-IP versions are explicitly out of scope per vendor policy.

CVSS 6.8 (Medium) with network attack vector and high-privilege requirement substantially reduces real-world exploitability compared to the raw score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C) indicates network-reachable but requires high administrative privileges and low attack complexity. No EPSS score or KEV status provided, and no POC publicly identified, suggesting this is not actively exploited in the wild. The scope change (S:C) indicates the impact crosses security boundaries-an admin deleting arbitrary files could disrupt system integrity or exfiltrate sensitive data. Real risk is moderate: exploitation requires a highly privileged, authenticated insider or lateral movement post-compromise to admin-level credentials. Organizations with strong role-based access control and audit logging of admin actions face lower practical risk than those with shared admin accounts or weak privilege separation.

An administrator whose credentials are compromised via phishing or password reuse attempts to delete critical system files using a crafted iControl REST API request with path traversal sequences (e.g., '../../etc/passwd'). The request is accepted due to the vulnerability in the undisclosed endpoint, allowing the attacker to traverse outside the intended directory and delete sensitive files, potentially rendering the BIG-IP appliance inoperable or exposing sensitive configuration data.