F5 BIG-IP CVE-2026-40462

Valid authentication credentials for BIG-IP iControl REST or TMOS shell are required (confirmed by CVSS PR:L). The vulnerability is triggered by execution of a specific undisclosed tmsh command or iControl REST endpoint that has incorrect permission assignment. No user interaction is needed (UI:N), and the attack is network-accessible (AV:N) with low complexity (AC:L), meaning any authenticated session can attempt exploitation once the vulnerable command is identified. The vulnerability is limited to authenticated users only - unauthenticated remote attackers cannot exploit this without first obtaining valid BIG-IP credentials. Exploitation does not require non-default configuration; any BIG-IP system with iControl REST or tmsh enabled (default state) is affected for users with the vulnerable command's scope.

CVSS 6.5 (network-accessible, low attack complexity, requires low privileges, high confidentiality impact) indicates moderate real-world risk. The requirement for prior authentication (PR:L) significantly limits exposure compared to unauthenticated network attacks, but any authenticated BIG-IP user-including support accounts, read-only operators, or compromised low-privilege accounts-can exploit this. EPSS data not provided, limiting exploitation probability assessment. No KEV status or public POC confirmed in available data, suggesting either limited public awareness or active exploitation not yet documented by CISA. The 'undisclosed command' notation implies this is a 0-day or recently-discovered vulnerability with vendor details withheld from public disclosure, increasing uncertainty about true exploitation prevalence. Organizations should prioritize patching if they grant broad authentication access (multiple user tiers) to BIG-IP management interfaces.

A support engineer or operator with read-only access to BIG-IP management (authenticated via iControl REST or tmsh) discovers the undisclosed command that bypasses permission checks. By executing this command, the attacker retrieves sensitive configuration data, SSL certificates, or user credentials normally restricted to full administrators. The attacker either uses this data for further lateral movement or exfiltrates it if the BIG-IP manages critical services.