BIG-IP and BIG-IQ CVE-2026-41957

Requires valid authenticated credentials to the F5 Configuration utility with at least low-privilege access level (PR:L), meaning any legitimate user account capable of logging into the web-based management interface can potentially exploit this. The Configuration utility must be network-accessible to the attacker, whether through internet exposure, VPN access, or compromise of an internal network segment with management VLAN connectivity. Exploitation does NOT require administrative privileges, non-default configuration, or specific feature enablement-any deployment running vulnerable BIG-IP or BIG-IQ versions with the standard Configuration utility enabled is exploitable once authentication is achieved. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning exploitation is straightforward and reliable once the authentication prerequisite is met. The primary limiting factor is the credential requirement itself, which defenders can control through access restrictions, MFA enforcement, and account monitoring.

Real-world risk is significant for organizations with BIG-IP/BIG-IQ deployments accessible to users with Configuration utility credentials. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable vulnerability with low complexity, requiring only low-privilege authentication and no user interaction-characteristics that make exploitation straightforward once credentials are obtained. The 8.8 base score reflects complete compromise potential (C:H/I:H/A:H) with unchanged scope. However, the PR:L requirement provides meaningful defense-in-depth: attackers must first obtain valid credentials to the management interface, which should be restricted to administrative networks and protected by multi-factor authentication. No public exploit identified at time of analysis and no CISA KEV listing suggest exploitation is not yet widespread, though the authenticated RCE primitive through deserialization is well-understood by attackers. Priority depends heavily on credential exposure risk: if Configuration utility is internet-exposed or accessible from compromised internal networks, this becomes critical. If management interfaces are properly isolated with MFA enforced, risk is substantially lower. The undisclosed vectors statement from F5 suggests details are being withheld to slow weaponization, indicating vendor awareness of exploitation potential.

An attacker who compromised help desk credentials or obtained low-privilege Configuration utility access through phishing sends a crafted HTTP request containing a malicious serialized object to the BIG-IP management interface. The Configuration utility deserializes the payload without proper validation, triggering arbitrary code execution with the privileges of the management application. The attacker establishes persistence by creating backdoor administrative accounts, exfiltrates SSL/TLS private keys and application configurations, and pivots to backend application servers using the BIG-IP's trusted position in the network architecture.