Which versions of F5 BIG-IP are affected by CVE-2026-39459?

F5 BIG-IP contains a privilege escalation vulnerability in iControl REST API and TMOS Shell that allows authenticated administrators with Manager role or higher to execute arbitrary commands and…. A patch is available.

How to fix or mitigate CVE-2026-39459?

Within 24 hours: Identify all F5 BIG-IP instances in your environment and document current firmware versions. Within 7 days: Apply the latest vendor-released patch to all affected BIG-IP systems; contact F5 support or consult security advisories for specific patched versions corresponding to your current firmware branch. Within 30 days: Audit administrative access logs for Manager-role or higher accounts on BIG-IP systems; review and restrict Manager role assignments to only essential personnel.

F5 BIG-IP CVE-2026-39459

Q: What is the CVSS score of CVE-2026-39459?

CVE-2026-39459 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29968 HIGH

Least Privilege Violation (CWE-272)

2026-05-13 f5

GHSA-pwjh-hfqc-xgc7

Information Disclosure Big Ip

8.6

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.2 (HIGH) 8.6 (HIGH)

Analysis Generated

May 13, 2026 - 15:49 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Authenticated attackers with Manager role or higher in F5 BIG-IP can execute arbitrary commands via malicious configuration objects in iControl REST API and TMOS Shell (tmsh). This privilege escalation vulnerability allows administrators to break out of their intended access boundaries and achieve full system control. CVSS 7.2 (High) reflects network accessibility with high privileges required. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

This vulnerability affects F5 BIG-IP's management interfaces: the iControl REST API (used for programmatic configuration and automation) and TMOS Shell (tmsh, the command-line interface for BIG-IP configuration). The root cause is CWE-272 (Least Privilege Violation), where configuration object creation mechanisms fail to properly restrict command execution capabilities. Users with Manager role - intended for configuration management but not system-level access - can craft configuration objects that embed and execute arbitrary system commands. This represents an authorization boundary violation where administrative privileges escalate to full OS-level control, typical of configuration management systems that insufficiently sanitize user-controlled input in configuration directives.

RemediationAI

Apply vendor-released patches per F5 Security Advisory K000160863 (https://my.f5.com/manage/s/article/K000160863), which provides version-specific upgrade paths and hotfix availability for supported BIG-IP releases. Organizations unable to immediately patch should implement compensating controls: restrict Manager role assignment to minimum necessary personnel with documented business justification, enable comprehensive audit logging for all iControl REST API calls and tmsh sessions with SIEM correlation for suspicious configuration object creation patterns, implement privileged access management (PAM) with session recording for all BIG-IP administrative access, enforce multi-factor authentication for Manager-level accounts, and segment management network access to prevent lateral movement post-exploitation. Note that role restriction does not eliminate the vulnerability but reduces attack surface by limiting credential targets. For EoTS versions, urgent migration planning to supported releases is required as no security patches will be issued.