Is there a patch available for CVE-2026-41217?

Yes, a patch is available for CVE-2026-41217. Update the affected software to the latest version immediately.

F5 BIG-IP TMOS CVE-2026-41217

Q: What is the CVSS score of CVE-2026-41217?

CVE-2026-41217 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29983 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-13 f5

GHSA-vg2p-cjx9-xffp

Information Disclosure Big Ip

8.3

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 13, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 13, 2026 - 16:22 NVD

6.0 (MEDIUM) 8.3 (HIGH)

Analysis Generated

May 13, 2026 - 15:58 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.0

DescriptionCVE.org

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

F5 BIG-IP TMOS shell (tmsh) allows authenticated administrators and resource administrators to execute arbitrary system commands with elevated privileges via an undisclosed command, potentially crossing security boundaries in Appliance mode deployments. The vulnerability requires high-privilege account access and local command-line interaction but poses significant risk to appliance-mode BIG-IP systems where privilege escalation could compromise the entire platform.

Technical ContextAI

BIG-IP TMOS (Traffic Management Operating System) is F5's core platform software running on BIG-IP appliances and virtual editions. The tmsh shell is the primary management interface for BIG-IP configuration and administration. The vulnerability stems from improper access control on a specific tmsh command (undisclosed in the description), classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). An authenticated user with administrative or resource administrator roles can leverage this command to execute arbitrary system commands with privileges higher than their assigned role should permit, effectively bypassing role-based access control (RBAC) boundaries. The affected CPE string cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:* indicates all versions of BIG-IP are potentially in scope, though the vendor advisory K000161107 will specify version limits and EoTS exclusions.

RemediationAI

Apply the vendor-released patch from F5 advisory K000161107 (https://my.f5.com/manage/s/article/K000161107), which specifies affected versions and recommended patch versions. Immediate steps: (1) Consult the advisory to identify patched versions for your current BIG-IP release line, (2) schedule patching during a maintenance window appropriate for your environment, (3) in high-security deployments, consider restricting tmsh command-line access to a minimal set of administrators until patching is complete. If immediate patching is not feasible, implement access controls to limit which user accounts hold resource administrator or administrator roles in TMOS, reducing the number of accounts that could abuse the vulnerability; this mitigates but does not eliminate risk. For Appliance mode deployments with strict security boundaries, verify post-patch that privilege escalation from virtual partition admin contexts to hypervisor/host is blocked.