Is there a patch available for CVE-2026-42063?

Yes, a patch is available for CVE-2026-42063. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-42063

Q: What is the CVSS score of CVE-2026-42063?

CVE-2026-42063 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29994 MEDIUM

Files or Directories Accessible to External Parties (CWE-552)

2026-05-13 f5

GHSA-3xq5-wvjc-3jpx

Information Disclosure Path Traversal Big Ip

6.9

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

4.9 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:57 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 4.9

DescriptionCVE.org

A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Authenticated high-privilege attackers with Resource Administrator or Administrator roles can download sensitive files from F5 BIG-IP iControl SOAP interface due to improper path validation. The vulnerability requires valid administrative credentials and does not affect versions that have reached End of Technical Support, limiting exposure to actively maintained deployments. No public exploit code or active exploitation has been identified.

Technical ContextAI

The iControl SOAP API in F5 BIG-IP implements file download functionality without adequate path traversal protection, allowing authenticated administrators to specify arbitrary file paths. CWE-552 (Files or Directories Accessible to External Parties) combined with path traversal logic enables attackers to escape intended directory restrictions and access files outside the intended scope. The vulnerability is specific to SOAP-based API calls rather than REST endpoints, affecting systems with iControl SOAP interface enabled. Attack surface is limited to network-accessible BIG-IP management interfaces with SOAP endpoints exposed.

RemediationAI

Apply the vendor-released patch from F5. The primary remediation is to update BIG-IP to a patched version identified in F5 advisory K000160973 available at https://my.f5.com/manage/s/article/K000160973. As an interim compensating control prior to patching, disable or restrict network access to the iControl SOAP API endpoint if REST API can fulfill administrative needs - this eliminates the attack vector but may require operational workflow changes. Additionally, enforce strict administrative access controls by implementing multi-factor authentication for administrative accounts and continuously monitor privileged API usage logs for suspicious file download patterns. Organizations unable to patch immediately should audit which administrators have Resource Administrator or Administrator roles and validate whether SOAP API access is necessary for their operational requirements.