Which versions of F5 BIG-IP are affected by CVE-2026-34176?

CVE-2026-34176 affects F5 BIG-IP appliances and allows authenticated administrators to execute arbitrary operating system commands, potentially compromising the security boundary between management…. A patch is available.

How to fix or mitigate CVE-2026-34176?

Within 24 hours: Inventory all F5 BIG-IP appliances in production and identify current firmware versions. Within 7 days: Apply vendor-released patch per F5 advisory K000160857 to all affected instances, prioritizing systems exposed to untrusted administrator networks. Within 30 days: Conduct post-patch validation testing and review administrative access controls to restrict iControl REST endpoint exposure to trusted management networks only.

F5 BIG-IP CVE-2026-34176

Q: What is the CVSS score of CVE-2026-34176?

CVE-2026-34176 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-29964 HIGH

OS Command Injection (CWE-78)

2026-05-13 f5

GHSA-9vx8-mp8v-r465

Command Injection Big Ip

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:49 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote command injection in F5 BIG-IP Appliance mode allows high-privilege authenticated attackers to execute arbitrary OS commands through an undisclosed iControl REST endpoint, crossing security boundaries between management and administrative contexts. CVSS 8.7 with scope change (S:C) indicates container escape or privilege domain breach. F5 has released vendor patches per advisory K000160857. No public exploit code or CISA KEV listing identified at time of analysis, limiting immediate mass-exploitation risk despite network attack vector.

Technical ContextAI

The vulnerability resides in F5's iControl REST API, the programmatic interface for BIG-IP configuration and management. CWE-78 (OS Command Injection) indicates improper neutralization of special characters in user input passed to system shell commands. The 'Appliance mode' restriction is significant - this hardened deployment mode locks down CLI/shell access and restricts administrative capabilities, making command injection a critical security boundary violation. The scope change (S:C) in CVSS vector signals the attacker breaks out of the iControl REST security context into broader system privileges. F5's CPE string cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:* with wildcard versioning suggests multiple product lines affected, but F5's advisory K000160857 contains specific version ranges. The undisclosed endpoint suggests F5 is withholding technical details to limit weaponization window.

RemediationAI

Apply vendor-released patches detailed in F5 Security Advisory K000160857 (https://my.f5.com/manage/s/article/K000160857), which specifies fixed versions for each affected BIG-IP release branch. As interim mitigation, restrict network access to iControl REST endpoints (typically TCP 443/8443) to trusted management networks only using firewall rules or BIG-IP's management interface access controls - this reduces exposure to PR:H attackers but does not eliminate insider threat or credential compromise scenarios. Implement multi-factor authentication for all administrative accounts to raise the privilege requirement bar. Audit administrative access logs for unusual iControl REST API activity, particularly POST/PUT requests to configuration endpoints. Monitor for unexpected child processes spawned by the httpd/REST daemon. Note that disabling iControl REST entirely breaks automation tooling and may impact orchestration workflows. Organizations unable to patch immediately should combine network isolation with enhanced credential monitoring as defense-in-depth, accepting residual risk from authenticated insiders or stolen credentials.