F5 BIG-IP TMOS CVE-2026-41217

Attacker must possess valid TMOS account credentials with resource administrator or administrator role. No other special configuration required for privilege escalation to occur; however, Appliance mode deployment is specifically required to achieve the 'cross security boundary' impact described. The vulnerability is triggered by invoking a specific, undisclosed tmsh command via the tmsh shell interface (typically accessible via SSH, console, or HTTPS management API). Local command-line access to tmsh (or remote access via authenticated SSH/management interface) is required; the vulnerability cannot be exploited over the network without valid administrative credentials. End-of-Technical-Support versions are excluded from the vulnerability scope by vendor policy.

CVSS 6.0 with vector AV:L/AC:L/PR:H/UI:N/S:U indicates local access requirement, high privilege prerequisites (resource administrator or administrator role), no user interaction needed, and unchanged scope - suggesting privilege escalation within the same system rather than cross-system compromise. The Scope:U rating conflicts with the description's mention of 'cross a security boundary in Appliance mode', which warrants clarification: in Appliance mode, administrative access to tmsh may represent a less-privileged boundary (e.g., virtual partition admin) that could escape to the hypervisor or host OS. The attack requires the attacker to already hold administrative credentials, significantly reducing the threat surface compared to unauthenticated remote vectors. However, the combination of (1) local privilege escalation, (2) undisclosed vulnerable command (making detection/mitigation difficult), and (3) Appliance mode boundary-crossing potential makes this moderately serious in high-security environments. EPSS and KEV status are not provided; without exploitation confirmation, this appears to be a post-disclosure vulnerability with vendor patch available, lower urgency than zero-day but requiring timely patching of production BIG-IP systems. The incomplete disclosure of the vulnerable command suggests F5 practices responsible disclosure to allow patching before public details emerge.

An authenticated administrator account on a BIG-IP system (obtained through credential compromise, insider threat, or legitimate but compromised account) invokes the undisclosed vulnerable tmsh command. The attacker passes system commands as parameters to this command, which executes them with elevated privileges (potentially root or system-level access). In an Appliance mode deployment, the attacker uses this to escape a virtual partition boundary or management context to access the underlying hypervisor or host OS.