F5 BIG-IP and BIG-IQ CVE-2026-42937

Exploitation requires valid authentication credentials to the BIG-IP or BIG-IQ management interface (confirmed by CVSS PR:L). The attacker must have network access to the management interface, which is typically restricted but may be exposed in cloud deployments or multi-tenant environments. No special product configuration is required; the vulnerability exists in default tmsh and iControl REST functionality. The vulnerability does NOT require administrative privileges-any authenticated user (service account, delegated read-only role, or basic operator role) can exploit it. The scope is limited to the management interface itself; no privilege escalation across system boundaries occurs. Exploitation is NOT blocked by firewalls that restrict management access to authorized administrators only, meaning organizations using network-based access control are the primary beneficiary of that mitigating control.

This vulnerability presents moderate-to-significant real-world risk despite the 6.5 CVSS score. The network attack vector (AV:N) combined with low complexity (AC:L) and low privileges required (PR:L) indicates accessible exploitation from remote locations by authenticated users-a common threat in environments with service accounts, API integrations, or multi-tenant administrative delegations. The confidentiality impact (C:H) is high, exposing network topology and adjacent device information that can enable reconnaissance for further attacks. However, the lack of integrity (I:N) or availability (A:N) impact limits direct damage. The requiring of authentication (PR:L) significantly reduces attack surface compared to unauthenticated vulnerabilities, but is not a complete mitigant in environments with numerous service accounts or overprivileged application integrations. The scope is unchanged (S:U), meaning no privilege escalation across administrative domains, but network disclosure can still support lateral movement reconnaissance. Exploitation likelihood appears moderate-this is a logic flaw requiring no special conditions, and disclosure of network topology is a valuable first step in multi-stage attacks. The authentication requirement substantially lowers wild exploitation probability compared to unauthenticated network vulns.

An attacker with valid but limited credentials (e.g., a compromised monitoring service account, a delegated read-only administrator, or an API integration account) authenticates remotely to the BIG-IP or BIG-IQ management interface via tmsh or iControl REST. The attacker executes the arp command in tmsh or queries network topology endpoints in iControl REST to enumerate adjacent devices, their MAC addresses, and IP assignments on the network segment. This reconnaissance reveals connected hosts and infrastructure, enabling the attacker to plan targeted attacks against discovered systems or to perform network segmentation bypass assessment.