Is there a patch available for CVE-2026-41959?

Yes, a patch is available for CVE-2026-41959. Update the affected software to the latest version immediately.

F5 BIG-IP and BIG-IQ CVE-2026-41959

Q: What is the CVSS score of CVE-2026-41959?

CVE-2026-41959 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29992 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-13 f5

GHSA-qxf3-7mw3-hq68

Information Disclosure Big Ip Big Iq

7.1

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 13, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 13, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

May 13, 2026 - 15:58 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Incorrect permission assignment in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and iControl REST allows authenticated attackers to view network status of destination systems. Affected versions vary by product line; vendor has released patches. Authentication is required, limiting exposure to users with valid credentials, but the high confidentiality impact (CVSS 6.5) makes this a material information disclosure risk for organizations managing sensitive network infrastructure.

Technical ContextAI

The vulnerability stems from improper access control enforcement (CWE-732) in two distinct F5 components: the TMOS Shell (tmsh) command-line interface used for system administration and diagnostics, and the iControl REST API which provides programmatic access to BIG-IP/BIG-IQ configuration and monitoring. The tmsh network diagnostics commands and iControl REST endpoints fail to properly validate that the authenticated user has the required permissions to view network status information, allowing privilege escalation or lateral access to sensitive network topology and status data that should be restricted by role-based access control policies.

RemediationAI

Apply vendor-released patch from F5 as documented in https://my.f5.com/manage/s/article/K000161022. Exact patched versions are not enumerated in available data; consult the F5 advisory to identify the correct upgrade path for your specific BIG-IP or BIG-IQ version and product line. As an interim control, restrict API access to tmsh network diagnostics commands and iControl REST endpoints to trusted administrative subnets or restrict them at the load balancer/firewall level. Additionally, implement role-based access control (RBAC) enforcement in F5 console settings to ensure only administrators requiring network diagnostics access are granted those permissions, though this does not address the underlying permission assignment bug. Monitor authentication logs for suspicious access patterns to tmsh and iControl REST by low-privilege accounts.