F5 BIG-IP CVE-2026-41225

Attacker must possess valid credentials for an account with Manager role or higher privilege level in F5 BIG-IP's Role-Based Access Control (RBAC) system. Network connectivity to the BIG-IP management interface on TCP port 443 (HTTPS) is required to access iControl REST API endpoints. The vulnerability affects default iControl REST configurations without requiring non-standard features or optional modules to be enabled. Exploitation is limited by the need for pre-existing privileged access, making this primarily a lateral movement and privilege persistence vulnerability rather than an initial access vector. Organizations with strict privileged access management, network segmentation isolating management interfaces, and comprehensive session monitoring face substantially reduced risk compared to environments with shared admin credentials or management interfaces exposed to production networks.

Real-world risk is moderate despite the 7.2 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible remote code execution with high impact across confidentiality, integrity, and availability, but the critical limiting factor is the PR:H (high privileges required) component - attackers must possess Manager-level credentials. This substantially reduces the threat surface to insider threats, compromised administrator accounts, or lateral movement scenarios where attackers have already achieved privileged access. No EPSS data is provided, but the high privilege requirement typically correlates with lower real-world exploitation probability. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept exists. For organizations with robust privileged access management, role segregation, and session monitoring, this represents lower priority than network-accessible unauthenticated vulnerabilities. However, for environments with shared administrator credentials, weak MFA enforcement, or limited privileged access auditing, this becomes a high-severity lateral movement and persistence vector. The patch availability from F5 (K000160916) enables immediate remediation for organizations maintaining current support contracts.

An attacker who has compromised a Manager-level administrator account through credential theft, phishing, or lateral movement authenticates to the BIG-IP iControl REST API over HTTPS. The attacker crafts a malicious configuration object POST request containing embedded shell commands disguised as configuration parameters. When the iControl REST service processes this object, it executes the embedded commands with system-level privileges, allowing the attacker to establish persistence through backdoor accounts, exfiltrate sensitive traffic management configurations and SSL private keys, or pivot to other network infrastructure using the BIG-IP device as a trusted intermediary.