Is there a patch available for CVE-2026-41954?

Yes, a patch is available for CVE-2026-41954. Update the affected software to the latest version immediately.

F5 BIG-IP and BIG-IQ CVE-2026-41954

Q: What is the CVSS score of CVE-2026-41954?

CVE-2026-41954 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29989 MEDIUM

Information Exposure (CWE-200)

2026-05-13 f5

GHSA-f568-29c8-2vx4

Information Disclosure Big Ip Big Iq

6.9

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

4.9 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:51 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 4.9

DescriptionCVE.org

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Sensitive information disclosure in F5 BIG-IP and BIG-IQ allows authenticated administrators with resource administrator role to view confidential data via undisclosed iControl REST endpoints or TMOS Shell commands. The vulnerability requires high-privilege authentication and produces no system modification or availability impact, limiting real-world risk despite network accessibility. Vendor has released patches addressing the information exposure.

Technical ContextAI

The vulnerability exists in the iControl REST API framework and TMOS Shell (tmsh) command-line interface, both core administrative interfaces in F5 BIG-IP and BIG-IQ systems. The iControl REST endpoint and specific tmsh command fail to enforce proper data filtering or access controls when returning configuration or operational data to authenticated users. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates inadequate output sanitization or overly permissive data access policies. The vulnerability is exposed via network interfaces (AV:N) but requires existing authentication credentials with resource administrator privileges, significantly limiting the attack surface compared to unauthenticated disclosure vulnerabilities.

RemediationAI

Apply the vendor-released patch from F5 article K32950402 immediately for all supported BIG-IP and BIG-IQ installations. The patch specifically addresses the iControl REST endpoint and tmsh command data filtering. No workarounds are documented; patching is the primary remediation. Interim compensating controls include: (1) restrict iControl REST API access via firewall or network segmentation to trusted management networks only (trade-off: reduces operational convenience for remote administrators), (2) audit and minimize the number of user accounts with resource administrator role privileges, (3) enable and monitor iControl access logs for suspicious data queries by high-privilege accounts. Organizations on EoTS versions should evaluate migration to supported releases as patching is not available for end-of-life products.