F5 BIG-IP CVE-2026-42058

Attacker must possess valid BIG-IP authentication credentials (low-privilege sufficient per CVSS PR:L). The iControl REST API must be accessible over the network (typically HTTPS on port 443 to the BIG-IP management IP). The undisclosed REST endpoint(s) that expose or enumerate user account names must be present in the deployed BIG-IP version. The BIG-IP must not have reached End of Technical Support (EoTS), per vendor's analysis scope. No special configuration is implied; exploitation is possible against default BIG-IP deployments once an attacker has gained any valid authentication credential. The attack does not require user interaction or specific system privileges beyond initial authentication.

CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-accessible, low-complexity exploitation requiring low-privilege authentication with no user interaction. The low CVSS score (4.3) appropriately reflects limited impact (confidentiality only, bounded scope) despite the straightforward attack vector. However, real-world risk depends on two critical factors: (1) prevalence of iControl REST exposure in internet-facing or hybrid deployments-F5 BIG-IP is commonly deployed at network perimeters, increasing exposure; (2) utility of user enumeration as reconnaissance for privilege escalation or targeted attacks against BIG-IP or downstream systems. The lack of EPSS score, KEV status, or POC data in the provided intelligence prevents assessment of actual exploitation prevalence. The restriction to non-EoTS versions limits scope but does not reduce severity for current deployments. Organizations should treat this as a medium-priority remediation for exposed instances, though it alone poses limited direct risk.

An authenticated attacker with valid BIG-IP credentials (obtained via credential stuffing, phishing, or insider threat) connects to the iControl REST API endpoint and sends a specially crafted request to an undisclosed enumeration endpoint. The API fails to validate the attacker's authorization level and returns a list of local BIG-IP user account names. The attacker uses this list to target known administrative accounts (e.g., 'admin', 'root') with brute-force password attacks or to research account names for spear-phishing campaigns against organization staff.