F5 BIG-IP CVE-2026-41953

Requires existing Resource Administrator role credentials, which is a highly privileged BIG-IP administrative account level (PR:H). Resource Administrator is not a default low-privilege user-it's the second-highest privilege tier in BIG-IP, below only full Administrator role, with extensive permissions to manage configuration objects including virtual servers, pools, and policies. Exploitation requires network access to the BIG-IP management interface (AV:N), though no additional complexity barriers exist once authenticated (AC:L). No user interaction required (UI:N). The vulnerability exists in the configuration management subsystem accessible to Resource Administrators, meaning it affects systems where this role is actively used for delegated administration rather than using only the full Administrator role.

Real-world risk is moderate-high despite the 8.7 CVSS score. The PR:H (high privileges required) significantly limits the attack surface-exploitation requires existing Resource Administrator credentials, which are highly privileged internal accounts. The AV:N/AC:L vector means remote exploitation is straightforward once authenticated, and S:C indicates the attacker can break out of their authorized role boundaries. EPSS data unavailable, but absence from CISA KEV suggests this is not seeing widespread active exploitation. The primary risk scenario is insider threat or compromised administrator accounts rather than external mass exploitation. Organizations with strict separation of duties between Resource Administrators and full administrators face higher risk. SSVC framework assessment: Exploitation status unknown, technical impact is total (S:C with administrative access), but automatable exploitation is unlikely due to authentication requirements. Priority depends heavily on your Resource Administrator account security posture.

An attacker who has compromised Resource Administrator credentials (through phishing, credential theft, or insider access) authenticates remotely to the BIG-IP management interface. They craft malicious configuration objects containing command injection payloads in object parameters. When the system processes these configuration changes, the injected commands execute with full administrative privileges, allowing the attacker to create new administrative accounts, modify security policies, or access sensitive traffic management data beyond their authorized Resource Administrator scope.