F5 BIG-IP CVE-2026-39459

Exploitation requires authenticated access with Manager role or higher privileges to F5 BIG-IP management interfaces (iControl REST API or TMOS Shell). Manager role is a standard administrative tier in BIG-IP RBAC intended for configuration management but below Administrator role. Network access to BIG-IP management plane (typically TCP 443 for iControl REST, TCP 22 for SSH/tmsh) is required per AV:N vector. Default BIG-IP installations include Manager role in standard deployment templates, making this a commonly assigned privilege level. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning once authenticated, exploitation is straightforward. No specific non-default configuration, optional features, or platform variants limit exploitation - affects all supported BIG-IP versions where Manager role has configuration object creation permissions.

Real-world risk is MODERATE despite High CVSS severity due to significant exploitation barriers. CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates low complexity but critically requires high privileges (Manager role), meaning attackers must first compromise legitimate administrator credentials or insider threat scenario applies. EPSS data not provided, but similar high-privilege vulnerabilities typically show low exploitation probability due to attacker prerequisites. No CISA KEV listing indicates no confirmed active exploitation. No public POC identified, reducing immediate weaponization risk. However, for organizations with multiple administrators or MSPs managing customer BIG-IP instances, this enables privilege escalation from configuration managers to root-equivalent access. Primary risk scenarios: compromised service accounts with Manager role, malicious insiders, or lateral movement after initial administrator compromise. Organizations without privileged access management (PAM) or role segregation face higher risk than those with strict RBAC enforcement and session monitoring.

An attacker who has compromised a service account with Manager role (perhaps through phishing, credential stuffing, or lateral movement from another system) connects to the BIG-IP iControl REST API endpoint. They craft a malicious configuration object - such as a custom monitor, iRule, or script profile - that embeds OS command injection payloads within object parameters. Upon object creation or activation, BIG-IP processes the configuration and executes the embedded commands with system-level privileges, granting the attacker full control to exfiltrate sensitive configuration data including SSL private keys, establish persistent backdoors, or pivot to backend application servers.