Which versions of F5 BIG-IP are affected by CVE-2026-42930?

CVE-2026-42930 affects F5 BIG-IP appliances and allows authenticated administrators with the Administrator role to bypass security controls designed to lock down system configuration in Appliance…. A patch is available.

How to fix or mitigate CVE-2026-42930?

Within 24 hours: inventory all F5 BIG-IP appliances currently deployed in Appliance mode and identify systems with Administrator-role accounts. Within 7 days: apply F5 vendor patch per Security Advisory K000160876 to test/non-production systems and validate functionality. Within 30 days: deploy patch to all production F5 BIG-IP appliances and review Administrator role assignments to limit accounts with this privilege.

F5 BIG-IP CVE-2026-42930

Q: What is the CVSS score of CVE-2026-42930?

CVE-2026-42930 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30007 HIGH

Path Traversal: '.../...//' (CWE-35)

2026-05-13 f5

GHSA-37mq-hr48-xhmc

Authentication Bypass Big Ip

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 13, 2026 - 16:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:50 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Authenticated administrators in F5 BIG-IP Appliance mode can bypass configuration restrictions designed to prevent system-level access. Administrators with the 'Administrator' role can circumvent Appliance mode lockdown controls, potentially modifying underlying system configurations that should be protected in this deployment mode. Vendor patch available per F5 Security Advisory K000160876. CVSS 8.5 reflects high confidentiality/integrity impact despite requiring privileged authentication.

Technical ContextAI

F5 BIG-IP Appliance mode is a restricted operational mode designed to limit administrative access to application delivery functions while preventing direct system-level configuration changes. The vulnerability is classified as CWE-35 (Path Traversal), suggesting administrators can access filesystem paths or configuration contexts outside their intended scope. The CVSS:4.0 vector shows network-accessible exploitation with low complexity but requiring high privileges (PR:H), indicating the attacker must already possess valid Administrator credentials. The attack affects only the vulnerable system (SC:N/SI:N/SA:N - no scope change), but grants high confidentiality and integrity access (VC:H/VI:H) to protected configurations.

RemediationAI

Apply vendor-released patches identified in F5 Security Advisory K000160876 at https://my.f5.com/manage/s/article/K000160876, which specifies exact fixed BIG-IP versions for each affected branch. Organizations unable to immediately patch should implement compensating controls: restrict Administrator role assignment to only essential personnel with verified business justification, enable multi-factor authentication for all administrative accounts, implement session monitoring and anomaly detection for admin activity focused on system-level configuration changes, and review audit logs for unauthorized access attempts to protected Appliance mode paths. Note that restricting network access to management interfaces does not mitigate this issue since legitimate administrators require network access (AV:N). Consider temporarily disabling Appliance mode if operational requirements permit and the security boundary it provides is compromised, though this trades security policy enforcement for patch timing flexibility.