Is there a patch available for CVE-2026-42937?

Yes, a patch is available for CVE-2026-42937. Update the affected software to the latest version immediately.

F5 BIG-IP and BIG-IQ CVE-2026-42937

Q: What is the CVSS score of CVE-2026-42937?

CVE-2026-42937 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30009 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-13 f5

GHSA-6r7x-m6rv-m3fh

Information Disclosure Big Ip Big Iq

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 13, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 13, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

May 13, 2026 - 15:58 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Incorrect permission assignment in F5 BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST allows authenticated attackers to view sensitive adjacent network information due to improper access controls. The vulnerability affects multiple product lines and requires valid authentication to exploit, making it a privilege escalation concern for environments where lower-privileged users have access to management interfaces.

Technical ContextAI

The vulnerability stems from improper permission configuration (CWE-732: Incorrect Permission Assignment for Critical Resource) in two distinct management interfaces. The tmsh shell commands (arp and ndp) and the iControl REST API fail to properly restrict access to network discovery and topology information. The arp command reveals ARP table contents showing adjacent devices, while ndp exposes IPv6 neighbor discovery information. iControl REST, F5's REST API for BIG-IP management, similarly fails to enforce proper authorization checks on network-related endpoints. These interfaces are typically accessed by administrators but may be exposed to lower-privileged service accounts or delegated administrators in role-based access control (RBAC) implementations.

RemediationAI

Apply the vendor-released patch from F5 as documented in article K000161018 (https://my.f5.com/manage/s/article/K000161018). The specific patched version numbers should be obtained directly from the F5 advisory. Until patches are applied, implement access control compensating measures: restrict tmsh shell access and iControl REST API endpoints to only necessary administrative accounts with strict RBAC policies limiting read permissions on network discovery commands (arp, ndp) and network-related REST endpoints. Disable or restrict access to iControl REST if not actively required for automation or monitoring. Segment management network access using firewall rules to limit which client networks can reach the management interface. Regularly audit and revoke unnecessary service account access to management interfaces. These mitigations reduce exposure but do not fully eliminate the vulnerability and may impact operational tooling.