Which versions of F5 BIG-IP and BIG-IQ are affected by CVE-2026-42406?

F5 BIG-IP and BIG-IQ Certificate Manager contains an arbitrary command execution vulnerability (CVE-2026-42406, CVSS 8.7) that allows highly privileged users with Certificate Manager role to execute…. A patch is available.

How to fix or mitigate CVE-2026-42406?

Within 24 hours: Inventory all F5 BIG-IP and BIG-IQ deployments and identify systems running Certificate Manager. Within 7 days: Apply vendor-released patch per F5 Security Advisory K000160971 to all affected systems, prioritizing production environments; verify Certificate Manager role assignment restrictions. Within 30 days: Conduct post-patch validation and implement enhanced monitoring of Certificate Manager administrative activities.

F5 BIG-IP and BIG-IQ CVE-2026-42406

Q: What is the CVSS score of CVE-2026-42406?

CVE-2026-42406 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29997 HIGH

Privilege Defined With Unsafe Actions (CWE-267)

2026-05-13 f5

GHSA-j3w3-p4g3-436q

Information Disclosure Big Ip Big Iq

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:50 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Arbitrary command execution in F5 BIG-IP and BIG-IQ Certificate Manager allows highly privileged attackers with Certificate Manager role to run OS commands by modifying configuration objects. The vulnerability requires network access and high privileges (PR:H) but enables scope change (S:C) with high confidentiality and integrity impact. Vendor-released patch available per F5 Security Advisory K000160971. EPSS data not provided; no confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability affects F5 BIG-IP Application Delivery Controllers and BIG-IQ Centralized Management platforms, specifically within the Certificate Manager component. The root cause is CWE-267 (Privilege Defined With Unsafe Actions), indicating that the Certificate Manager role has excessive permissions that allow configuration object modifications beyond its intended scope. The CVSS scope change metric (S:C) suggests the vulnerability enables an attacker to break out of the intended security boundary of the Certificate Manager role to affect resources under a different authority - in this case, executing arbitrary operating system commands on the underlying F5 system. The affected CPE strings (cpe:2.3:a:f5:big-ip and cpe:2.3:a:f5:big-iq) indicate broad impact across both product lines, though F5 has not evaluated End of Technical Support versions. The network attack vector (AV:N) means exploitation can occur remotely through management interfaces rather than requiring local system access.

RemediationAI

Apply vendor-released patches detailed in F5 Security Advisory K000160971 available at https://my.f5.com/manage/s/article/K000160971. The advisory should specify exact fixed versions for both BIG-IP and BIG-IQ product lines. Until patching is complete, implement compensating controls: restrict Certificate Manager role assignment to only personnel who absolutely require certificate lifecycle management functions, enforce multi-factor authentication for all administrative access to BIG-IP/BIG-IQ management interfaces, implement network segmentation to limit management interface exposure (bind to dedicated management VLANs rather than production networks), enable comprehensive audit logging for all configuration changes especially those made by Certificate Manager role accounts, and review recent configuration object modifications for unauthorized changes that could indicate exploitation attempts. Note that restricting Certificate Manager role may impact legitimate certificate renewal workflows - coordinate with teams responsible for SSL/TLS certificate operations before implementing role restrictions.