F5 BIG-IP EUVD-2026-29985

The QKView utility must be accessible to the authenticated user (enabled by default in BIG-IP and BIG-IQ). The user must possess valid credentials with privileges sufficient to generate QKView diagnostic files-typically any authenticated user account including low-privileged monitoring, read-only, or guest roles can trigger QKView generation and access the resulting file. No special network conditions or non-standard configuration is required. Exploitation is limited to authenticated users; remote unauthenticated attackers cannot exploit this vulnerability. The attacker must have a valid user account and network access to the BIG-IP or BIG-IQ management interface (SSH, web UI, or API). Default deployments with standard user authentication enabled are vulnerable.

CVSS 6.5 (Medium-High) combined with mandatory authentication (PR:L) indicates moderate real-world risk primarily to organizations with insider threat concerns or where low-privileged accounts (e.g., read-only monitoring roles, junior operators) have been compromised. The network vector (AV:N) and low complexity (AC:L) mean exploitation requires no special network conditions or attack complexity once a valid credential is obtained. The high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) confirms this is a pure information disclosure risk. EPSS scoring data is not provided, but the CVSS profile suggests this is not a critical remote code execution or denial-of-service vector; however, in environments where QKView files are shared with F5 support, third-party contractors, or stored in version control systems, the exposure multiplier increases significantly. Exploitation requires legitimate authenticated access, which substantially reduces opportunistic attack surface compared to unauthenticated vulnerabilities. The limiting factor is credential compromise or misuse by authorized personnel.

A junior network operator with read-only monitoring permissions on BIG-IP gains access to the QKView diagnostic utility through the management interface. The operator generates a QKView file containing system diagnostics and downloads it to their workstation for troubleshooting purposes. Without proper sanitization, the QKView archive includes unredacted administrative passwords, SSL private keys, and authentication tokens embedded in configuration snippets. The operator then either intentionally exfiltrates the file to an external system, shares it in a public repository, or a threat actor compromises the operator's workstation and discovers the QKView file in temporary storage, gaining access to credentials that enable lateral movement within the F5 infrastructure or connected backend systems.