Skip to main content

F5 BIG-IP EUVDEUVD-2026-29975

| CVE-2026-40462 HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2026-05-13 f5 GHSA-m5rw-fq84-2jg3
Information Disclosure Big Ip
7.1
CVSS 4.0 · Vendor: f5
Share

Severity by source

Vendor (f5) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Re-analysis Queued
May 13, 2026 - 16:22 vuln.today
cvss_changed
Severity Changed
May 13, 2026 - 16:22 NVD
MEDIUM HIGH
CVSS changed
May 13, 2026 - 16:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)
Patch available
May 13, 2026 - 16:03 EUVD
Analysis Generated
May 13, 2026 - 15:51 vuln.today
CVE Published
May 13, 2026 - 14:12 nvd
MEDIUM 6.5

DescriptionCVE.org

Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Incorrect permission assignment in F5 BIG-IP iControl REST and TMOS shell (tmsh) allows authenticated attackers to view sensitive information through an undisclosed command. The vulnerability affects BIG-IP systems and requires valid credentials but no user interaction to exploit, enabling confidentiality compromise of data restricted to higher-privilege accounts.

Technical ContextAI

The vulnerability exists in iControl REST, F5's RESTful API interface for BIG-IP management, and the TMOS shell (tmsh), the command-line management interface for BIG-IP. The root cause is improper permission assignment (CWE-732) on an undisclosed tmsh or iControl REST command, allowing authenticated users with lower privileges to access endpoints or execute commands that should be restricted to administrators. This is a privilege escalation vector within an already-authenticated session, exploiting the principle of least privilege violation in the TMOS access control model.

RemediationAI

Obtain and apply the vendor-released security patch from F5 for BIG-IP via the advisory at https://my.f5.com/manage/s/article/K83991477. Specific patch versions are not disclosed in available data; consult the F5 advisory for exact affected versions and their fixes. Interim mitigations pending patch deployment include: (1) Restrict iControl REST and tmsh access to trusted administrator networks only, using network segmentation and firewall rules to limit management plane access; (2) Implement role-based access control (RBAC) with principle of least privilege, granting only required permissions to each user account and avoiding overly permissive operator roles; (3) Monitor tmsh and iControl REST audit logs for suspicious command execution or data access by low-privilege accounts; (4) Disable iControl REST on management interfaces if not required for automated tooling, reducing the attack surface. Note that workarounds do not eliminate the underlying permission bug and should be temporary measures only.

More in Big Ip

View all
CVE-2026-41957 HIGH
8.7 May 13

Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
CVE-2026-59762 HIGH
8.7 Jul 15

Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
CVE-2026-39455 HIGH
8.7 May 13

Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
CVE-2026-42409 HIGH
8.7 May 13

Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via

CVE-2026-40423 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
CVE-2026-39458 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles

CVE-2026-40060 HIGH
8.7 May 13

F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
CVE-2026-41227 HIGH
8.7 May 13

Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
CVE-2026-40618 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
CVE-2026-41956 HIGH
8.7 May 13

Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
CVE-2026-42920 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
CVE-2026-40629 HIGH
8.7 May 13

Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

EUVD-2026-29975 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy