F5 BIG-IP and BIG-IQ CVE-2026-42406

Attacker must possess valid credentials for an account with Certificate Manager role or higher privileges on the BIG-IP or BIG-IQ system. Network access to the management interface is required (AV:N in CVSS vector), meaning either direct exposure of management interfaces to attacker-controlled networks or compromise of a system with legitimate management access. No additional user interaction (UI:N) or complex timing/race conditions (AC:L) are required beyond the initial authentication. The vulnerability exploits functionality accessible through normal management workflows, suggesting it works against default configurations without requiring specific non-standard settings. Organizations that have not deployed Certificate Manager functionality or have no accounts assigned this role are not exploitable through this specific attack path.

Real-world risk is moderate despite the high CVSS score of 8.7. The vulnerability requires high privileges (PR:H) and specifically the Certificate Manager role, significantly limiting the initial attacker pool to insiders or attackers who have already compromised administrative credentials through other means. The scope change and high confidentiality/integrity impact indicate this is a privilege escalation vector rather than initial access, making it most dangerous in supply chain scenarios or environments with overly broad role assignments. The low attack complexity (AC:L) and network vector (AV:N) mean that once an attacker has the required credentials, exploitation is straightforward without additional hurdles. EPSS probability data not provided for direct comparison. No CISA KEV listing indicates this is not being exploited at scale in the wild, and no public POC availability confirmed, reducing immediate urgency. However, F5 infrastructure is high-value in enterprise networks - compromise could enable lateral movement, traffic interception, or cryptographic material theft. Priority should be high for organizations running BIG-IP/BIG-IQ in critical roles (perimeter security, SSL/TLS termination, API gateways) or where Certificate Manager role is broadly assigned. Organizations with strict role segregation and minimal Certificate Manager access face lower practical risk.

An attacker who has compromised credentials for an account with Certificate Manager role (through phishing, credential stuffing, or insider threat) connects remotely to the BIG-IP or BIG-IQ management interface. They navigate to certificate management functions and modify specific configuration objects in a way that the system improperly processes as operating system commands rather than configuration parameters. These commands execute with the privileges of the underlying F5 system process, potentially enabling installation of backdoors, exfiltration of SSL/TLS private keys and certificates, or pivoting to other network segments accessible from the F5 appliance.