F5 BIG-IP and BIG-IQ CVE-2026-41954

Authentication with resource administrator role privileges is strictly required - unauthenticated attackers cannot trigger this vulnerability (PR:H in CVSS vector). The attacker must have valid login credentials for the iControl REST API or tmsh command interface. Access to the specific undisclosed REST endpoint or the particular tmsh command is necessary; not all administrative functions expose the vulnerability. Default configurations of BIG-IP and BIG-IQ are potentially affected, as no special configuration is described as required to enable the vulnerable endpoint or command. The vulnerability does not require user interaction and works across network boundaries, but is fundamentally gated by the authentication requirement, making it primarily an insider threat or post-compromise scenario rather than a perimeter attack vector.

This vulnerability presents moderate real-world risk with important caveats. CVSS 4.9 reflects the confidentiality impact (C:H) balanced against the requirement for high-privilege authentication (PR:H), resulting in a below-threshold but not negligible score. The CVSS vector confirms network accessibility (AV:N) with low complexity (AC:L), meaning no special conditions are needed beyond valid admin credentials. Notably absent: KEV (CISA known exploited vulnerabilities) status - no indication of active exploitation. No public proof-of-concept code referenced. The high-privilege requirement (resource administrator role) significantly narrows the threat actor pool to insiders or compromise scenarios where admin credentials are already obtained. SSVC framework perspective: exploitation is unconfirmed (no KEV, no POC), technical impact is high (C:H), but impact scope is constrained to authenticated information disclosure without lateral movement or system compromise vectors. Organizations with strict admin credential management and role-based access controls see lower practical risk; those with shared admin accounts or weak credential hygiene face elevated insider threat exposure. The missing specification of which data is disclosed (configuration passwords, API keys, customer data?) limits precise risk quantification.

An authenticated resource administrator (legitimate or compromised credential) connects to the BIG-IP or BIG-IQ management interface via iControl REST or tmsh console. The attacker queries an undisclosed endpoint or executes a specific tmsh command that returns configuration data, encryption keys, or operational secrets that should be restricted from that admin's view. The attacker exports the sensitive data for use in lateral movement, credential harvesting, or data theft, without triggering any alerts since the activity appears as legitimate administrative access.