F5 BIG-IP EUVD-2026-29980

Low-privilege authentication credentials for the BIG-IP Configuration utility are required-the vulnerability cannot be exploited by unauthenticated remote attackers. The attacker must have network access to the Configuration utility endpoint (typically accessible on the management interface). The vulnerability applies only to actively-supported BIG-IP versions; versions that have reached End of Technical Support are explicitly out of scope per vendor guidance. No special configuration or non-default deployment mode is stated in the description, implying the vulnerability exists in standard BIG-IP installations.

CVSS 6.5 with network-accessible attack vector (AV:N) and low complexity (AC:L) indicates straightforward remote exploitation against any BIG-IP instance on the network. The requirement for low-privilege authentication (PR:L) is a meaningful constraint-the attacker must first obtain valid credentials, limiting the threat to insider threats, compromised service accounts, or accounts obtained through credential stuffing. However, the high confidentiality impact (C:H) combined with no integrity or availability impact suggests this is a pure information disclosure channel. EPSS data not provided, but the attack vector and authentication barrier suggest this ranks below zero-day remote code execution threats. The vendor's explicit exclusion of EoTS versions from evaluation implies this advisory targets actively-supported BIG-IP releases only, reducing the true vulnerable install base. Real-world risk depends heavily on credential exposure frequency and whether Configuration utility access is restricted via network segmentation in the target environment.

An attacker obtains low-privilege credentials for a BIG-IP instance (e.g., through credential reuse or phishing) and authenticates to the Configuration utility. The attacker then navigates to or crafts HTTP requests targeting undisclosed pages within the utility, leveraging the XPath injection flaw to retrieve sensitive configuration data such as SSL certificates, authentication credentials, or traffic policies without any additional user interaction.