Which versions of F5 BIG-IP are affected by EUVD-2026-29986?

CVE-2026-41225 affects F5 BIG-IP iControl REST and allows authenticated administrators with Manager role or higher to execute arbitrary commands, creating a critical insider threat vector.. A patch is available.

How to fix or mitigate EUVD-2026-29986?

Within 24 hours: Inventory all F5 BIG-IP iControl REST deployments and document current versions. Within 7 days: Apply vendor-released patch per F5 advisory K000160916 to all affected BIG-IP systems, prioritizing production environments; test patches in staging first. Within 30 days: Complete patch deployment across all BIG-IP infrastructure, audit Manager-role user accounts for anomalies, and implement additional access controls limiting Manager-level credentials.

F5 BIG-IP EUVD-2026-29986

Q: What is the CVSS score of EUVD-2026-29986?

EUVD-2026-29986 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41225 HIGH

Incorrect Use of Privileged APIs (CWE-648)

2026-05-13 f5

GHSA-mpcv-vxv9-9h8x

Information Disclosure Big Ip

8.6

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.2 (HIGH) 8.6 (HIGH)

Analysis Generated

May 13, 2026 - 15:49 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

F5 BIG-IP iControl REST allows authenticated attackers with Manager role or higher to execute arbitrary commands through malicious configuration objects. This authenticated remote code execution vulnerability carries a CVSS score of 7.2 but requires high privileges (Manager role), significantly limiting the attack surface to insider threats or compromised administrator accounts. No public exploitation or proof-of-concept has been identified at time of analysis, and F5 has released vendor patches per advisory K000160916.

Technical ContextAI

The vulnerability affects F5 BIG-IP's iControl REST API, the primary management interface for programmatic configuration and automation of BIG-IP devices. iControl REST enables administrators to create, modify, and delete configuration objects through HTTP/HTTPS requests. The underlying weakness is CWE-648 (Incorrect Use of Privileged APIs), where the API fails to properly validate or sanitize configuration object parameters that can contain executable commands. This allows privileged users to craft configuration objects that escape intended constraints and execute arbitrary system commands with the privileges of the iControl REST process. The affected CPE (cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*) indicates broad version exposure across BIG-IP product lines, though specific version ranges require vendor advisory consultation.

RemediationAI

Apply vendor-supplied patches immediately as documented in F5 Security Advisory K000160916 (https://my.f5.com/manage/s/article/K000160916). The advisory specifies exact fixed versions for each affected BIG-IP release branch and provides upgrade procedures. For environments where immediate patching is not feasible, implement compensating controls: restrict iControl REST access to dedicated management VLANs with firewall rules blocking access from production networks, enforce multi-factor authentication for all Manager-role accounts, implement privileged session recording and real-time monitoring for iControl REST API calls, reduce the number of accounts with Manager privileges following least-privilege principles, and enable comprehensive audit logging for all configuration object creation operations with SIEM alerting on anomalous API usage patterns. Note that restricting network access to iControl REST may impact automation workflows and orchestration tools, requiring updates to management architecture. Configuration auditing may generate substantial log volume in environments with frequent automated changes.