F5 BIG-IP CVE-2026-42924

Exploitation requires authenticated access with Resource Administrator or Administrator role privileges on F5 BIG-IP systems. The iControl SOAP API must be enabled and network-accessible to the attacker. This is a default configuration on many BIG-IP deployments as SOAP remains enabled for backward compatibility with legacy management tools. The vulnerability is exploitable remotely (AV:N) over the management network without requiring user interaction (UI:N). Attack complexity is Low (AC:L), indicating no special timing, race conditions, or environmental dependencies beyond the authentication requirement. Limiting factors: high privilege requirement means attackers must first compromise administrator credentials through separate attack vectors such as credential theft, social engineering, or prior system compromise. Organizations that have migrated entirely to iControl REST API and explicitly disabled SOAP endpoints are not exposed.

Real-world risk is MODERATE despite the 8.7 CVSS score. The attack requires high-privilege credentials (PR:H) - Resource Administrator or Administrator roles - which already grant extensive system access, limiting the practical security boundary crossed. The Changed Scope (S:C) elevates severity because attackers escape role-based access controls to achieve root-level OS command execution beyond intended administrative permissions. Attack complexity is Low (AC:L) with no user interaction required, making exploitation straightforward for credential holders. No EPSS score, KEV status, or public exploit code information provided in available data - absence of KEV listing suggests no confirmed active exploitation campaigns detected. The requirement for high-privilege authentication substantially reduces the population of potential attackers compared to unauthenticated or low-privilege flaws. Primary risk scenario: compromised administrator accounts (via phishing, credential stuffing, or insider threat) being leveraged for full system compromise. Organizations with strict role separation between Resource Administrators and full system administrators face greater risk as this vulnerability undermines that security model. The legacy nature of iControl SOAP means modern deployments using only iControl REST may have reduced or no exposure depending on whether SOAP endpoints remain enabled.

An attacker who has compromised Resource Administrator credentials through phishing or password reuse authenticates to the BIG-IP management interface. They craft a malicious SNMP configuration object via the iControl SOAP API, embedding shell command injection payloads in configuration parameters such as SNMP community strings or trap destinations. When BIG-IP processes this configuration, the injected commands execute with root privileges on the underlying operating system, allowing the attacker to install backdoors, exfiltrate sensitive configuration data including SSL private keys and authentication databases, or pivot to other systems in the management network.