Is there a patch available for CVE-2026-42058?

Yes, a patch is available for CVE-2026-42058. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-42058

Q: What is the CVSS score of CVE-2026-42058?

CVE-2026-42058 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29993 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-13 f5

GHSA-7qp2-pc79-f5gh

Information Disclosure Big Ip

5.3

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:58 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 4.3

DescriptionCVE.org

An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

F5 BIG-IP iControl REST API allows authenticated attackers to enumerate local user account names through undisclosed requests, leading to information disclosure of administrative user identities. The vulnerability requires valid authentication credentials and network access to the iControl REST interface, affecting systems with BIG-IP versions that have not reached End of Technical Support. CVSS 4.3 (low) reflects the requirement for prior authentication and confidentiality-only impact, though the enumeration of administrative accounts could facilitate downstream attacks.

Technical ContextAI

BIG-IP's iControl REST API is the primary management interface for F5 load balancers and application delivery controllers. The vulnerability stems from insufficient access controls (CWE-732: Incorrect Permission Assignment for Critical Resource) on REST endpoints that expose or allow enumeration of local user account names without proper authorization checks. The affected API likely fails to validate that authenticated users should only access their own account information or have explicit administrative permissions to enumerate accounts. iControl REST handles administrative operations including user management, configuration, and monitoring across BIG-IP deployments.

RemediationAI

Apply the vendor-released patch from F5 as referenced in advisory K000160903 (https://my.f5.com/manage/s/article/K000160903). The patch remediates the insufficient access control on iControl REST endpoints that allow user enumeration. Until patching is feasible, implement network-level compensating controls: restrict iControl REST access (default port 443) to trusted administrative networks using firewall rules or network ACLs; disable iControl REST entirely if not actively used for automation, reverting to the legacy SOAP-based iControl API if available; enforce strong authentication policies (multi-factor authentication, IP whitelisting) on any accounts with iControl REST access to reduce likelihood of credential compromise that could enable this attack. Note that network restriction does not eliminate risk if legitimate administrative access is required from less-trusted networks.