EUVD-2026-29994
GHSA-3xq5-wvjc-3jpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain administrative credentials
-
DeliveryAuthenticate to iControl SOAP API
-
ExploitCraft path traversal file download request
-
ExecutionRetrieve sensitive files outside intended directory
-
ImpactExfiltrate configuration or secrets data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK
2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess valid BIG-IP administrative credentials with Resource Administrator or Administrator role assignment. The iControl SOAP API endpoint must be accessible from the attacker's network position (typically the management network). The affected BIG-IP version must be in an actively supported release (EoTS versions are excluded per vendor statement). The SOAP interface must not be disabled or further network-restricted by firewall or administrative policy. No special application configuration is needed beyond standard iControl SOAP service operation. |
| Impact | This vulnerability presents moderate real-world risk despite a CVSS score of 4.9, which underrepresents impact due to its authentication requirement. The high-privilege requirement (PR:H) significantly limits exploitability - only Resource Administrators and full Administrators can trigger the flaw, effectively making this an insider threat or credential compromise scenario. CVSS vector AV:N/AC:L/UI:N/S:U/C:H/I:N/A:N indicates confidentiality breach (full file access) with no integrity or availability impact. The lack of KEV listing, public POC, or exploitation reports suggests this is not an active threat vector in the wild. However, for organizations with weak administrative credential hygiene or those concerned about malicious insiders, the confidentiality impact is significant. The EoTS exclusion means unsupported versions are not considered vulnerable by F5, reducing the apparent affected install base. |
| Exploit ScenarioDerived | A disgruntled system administrator with valid BIG-IP Resource Administrator credentials authenticates to the iControl SOAP interface and crafts a malicious file download request using path traversal sequences (e.g., '../../../etc/passwd') to exfiltrate configuration files, private keys, or other sensitive data stored on the BIG-IP system. Because PR:H is required, this attack is only viable if the attacker already possesses or has compromised administrative credentials, making it a post-authentication threat. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 13, 2026
Authenticated high-privilege attackers with Resource Administrator or Administrator roles can download sensitive files from F5 BIG-IP iControl SOAP interface due to improper path validation. The vulnerability requires valid administrative credentials and does not affect versions that have reached End of Technical Support, limiting exposure to actively maintained deployments. No public exploit code or active exploitation has been identified.
RemediationAI
Apply the vendor-released patch from F5. The primary remediation is to update BIG-IP to a patched version identified in F5 advisory K000160973 available at https://my.f5.com/manage/s/article/K000160973. As an interim compensating control prior to patching, disable or restrict network access to the iControl SOAP API endpoint if REST API can fulfill administrative needs - this eliminates the attack vector but may require operational workflow changes. Additionally, enforce strict administrative access controls by implementing multi-factor authentication for administrative accounts and continuously monitor privileged API usage logs for suspicious file download patterns. Organizations unable to patch immediately should audit which administrators have Resource Administrator or Administrator roles and validate whether SOAP API access is necessary for their operational requirements.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The iControl SOAP API in F5 BIG-IP implements file download functionality without adequate path traversal protection, allowing authenticated administrators to specify arbitrary file paths. CWE-552 (Files or Directories Accessible to External Parties) combined with path traversal logic enables attackers to escape intended directory restrictions and access files outside the intended scope. The vulnerability is specific to SOAP-based API calls rather than REST endpoints, affecting systems with iControl SOAP interface enabled. Attack surface is limited to network-accessible BIG-IP management interfaces with SOAP endpoints exposed.
Know when Big Ip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Exploit-DB