Is there a patch available for CVE-2026-42919?

Yes, a patch is available for CVE-2026-42919. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-42919

Q: What is the CVSS score of CVE-2026-42919?

CVE-2026-42919 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30003 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-13 f5

GHSA-w3xh-p84j-v7qw

Stack Overflow Buffer Overflow Big Ip

7.1

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 13, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 13, 2026 - 16:22 NVD

6.7 (MEDIUM) 7.1 (HIGH)

Analysis Generated

May 13, 2026 - 15:52 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.7

DescriptionCVE.org

A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Privilege escalation in F5 BIG-IP allows authenticated administrators to cross security boundaries and achieve elevated system access through a stack buffer overflow. The vulnerability affects all BIG-IP versions and requires high-privilege administrative credentials and direct network access to exploit. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.

Technical ContextAI

The vulnerability is a stack-based buffer overflow (CWE-121) in F5 BIG-IP systems. BIG-IP is a suite of application delivery and security products that operate at the network edge. The buffer overflow occurs in a privileged code path accessible only to authenticated administrators with high-level privileges (PR:H in CVSS vector). The root cause is improper bounds checking in memory operations, allowing an authenticated attacker to overwrite stack memory and hijack execution flow to escalate from administrative to system-level privileges or bypass security boundaries enforced by the application.

RemediationAI

Apply the vendor-released patch available from F5 at https://my.f5.com/manage/s/article/K000158971. Consult this advisory for exact patched version numbers corresponding to your BIG-IP deployment (version numbering varies across BIG-IP product lines: Virtual Edition, Hardware appliances, etc.). Interim mitigations pending patch deployment include: restrict administrative access via network segmentation, enforcing administrative connections only from trusted management networks via firewall rules; implement multi-factor authentication for all BIG-IP administrative accounts to reduce likelihood of credential compromise enabling exploitation; audit and review active administrative sessions regularly to detect unauthorized access; monitor system logs for unexpected administrative privilege escalation attempts. These controls do not eliminate the vulnerability but reduce the attack surface by limiting who can reach and authenticate to the admin interface.