EUVD-2026-29965
GHSA-v5r2-235p-jc3x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
5DescriptionCVE.org
An authenticated iControl SOAP user may be able to obtain information of other accounts.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
Authenticated users of F5 BIG-IP iControl SOAP interface can access account information belonging to other users due to insufficient access controls. The vulnerability affects BIG-IP systems where iControl SOAP is accessible and requires valid authentication credentials to exploit, allowing attackers with legitimate access to enumerate or retrieve confidential account details beyond their authorization scope.
Technical ContextAI
The vulnerability resides in the iControl SOAP API, F5 BIG-IP's management interface that exposes administrative functions via SOAP web services. CWE-266 (Incorrect Privilege Assignment) indicates that the SOAP endpoint fails to properly validate authorization levels when handling account information requests, allowing an authenticated principal to access resources assigned to other accounts. The iControl SOAP interface is commonly used for programmatic administration and monitoring of BIG-IP configurations, making this a high-value attack surface for lateral privilege escalation within administrative environments.
RemediationAI
Apply the vendor-released patch from F5 via advisory K000159021 (https://my.f5.com/manage/s/article/K000159021). F5 account and product support access are required to retrieve and deploy the patch. Pending patch deployment, restrict network access to iControl SOAP ports (typically TCP 443 for management) to trusted administrative hosts and networks using firewall rules or F5's built-in management IP restrictions. Audit iControl SOAP user accounts and disable inactive credentials to reduce lateral movement opportunity from potentially compromised accounts. Monitor iControl SOAP API logs for account enumeration patterns (repeated queries to account endpoints by individual users) as a detective control. Note that access restrictions may limit legitimate management automation and monitoring tools, requiring operational coordination.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today