F5 BIG-IP and BIG-IQ EUVD-2026-29961

Exploitation requires compromised credentials for an account holding at least Certificate Manager role privileges in BIG-IP or BIG-IQ (PR:H in CVSS vector). The Certificate Manager role must have permission to modify configuration objects that are processed by privileged system services. Network access to the management interface is required (AV:N), but no user interaction is needed once authenticated (UI:N). Attack complexity is low (AC:L) suggesting no additional timing, race condition, or environmental prerequisites beyond the role-based access. The scope change (S:C) indicates the vulnerability transcends the web management application's security boundary, executing commands in the underlying OS context. Exploitation is NOT possible against default read-only user roles, monitoring-only accounts, or unauthenticated access - the high privilege requirement is a significant limiting factor that narrows real-world exploitability to post-credential-compromise scenarios.

Real-world risk is constrained by the high privilege requirement (PR:H) - attackers need Certificate Manager role credentials before exploitation. The CVSS 8.7 score primarily reflects the scope change and confidentiality/integrity impacts rather than ease of exploitation. Attack complexity is low (AC:L) once authenticated, and network attack vector (AV:N) means remote exploitation is possible. However, the prerequisite of compromised high-privilege credentials significantly limits the attack surface compared to unauthenticated or low-privilege vulnerabilities. No EPSS score provided in available data. Not listed in CISA KEV, indicating no confirmed active exploitation in the wild. No public exploit identified at time of analysis. SSVC assessment suggests this is a targeted threat scenario rather than widespread opportunistic exploitation - priority depends on whether Certificate Manager credentials have been compromised in your environment or if insider threat risk is elevated. Organizations should prioritize based on detection of suspicious Certificate Manager activity rather than treating as critical for all BIG-IP/BIG-IQ deployments. The primary risk is post-compromise lateral movement or privilege escalation after initial credential theft via phishing, supply chain, or insider access.

An attacker who has obtained Certificate Manager credentials through phishing or compromised a certificate administrator's workstation authenticates remotely to the BIG-IP management interface. They navigate to certificate management configuration objects and inject malicious commands into fields processed by backend configuration handlers. When the system processes these modified configuration objects, the injected commands execute in a higher-privileged context, allowing the attacker to read sensitive configuration data, modify traffic routing rules, or establish persistent backdoor access to the underlying operating system.