Which versions of F5 BIG-IP are affected by EUVD-2026-29988?

F5 BIG-IP contains a privilege escalation vulnerability (CVE-2026-41953, CVSS 8.7) that allows authenticated Resource Administrators to gain full administrative control through configuration…. A patch is available.

How to fix or mitigate EUVD-2026-29988?

Within 24 hours: identify all F5 BIG-IP instances in your environment and document current versions. Within 7 days: obtain the vendor-released patch from F5 and establish testing schedule; restrict Resource Administrator role assignments to only essential personnel pending patching. Within 30 days: apply patch to all BIG-IP systems, prioritizing production load balancers and those handling sensitive traffic.

F5 BIG-IP EUVD-2026-29988

Q: What is the CVSS score of EUVD-2026-29988?

EUVD-2026-29988 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41953 HIGH

Command Injection (CWE-77)

2026-05-13 f5

GHSA-qqpg-xxjc-9jh9

Privilege Escalation Command Injection Big Ip

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:48 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Privilege escalation in F5 BIG-IP allows authenticated Resource Administrator users to elevate privileges through configuration object manipulation. The command injection flaw (CWE-77) enables attackers with existing high-privilege access to gain administrative control over the BIG-IP system. CVSS score of 8.7 reflects high impact due to scope change (compromising beyond the vulnerable component), though exploitation requires existing Resource Administrator credentials (PR:H). EPSS data not provided; no CISA KEV listing indicates targeted rather than widespread exploitation.

Technical ContextAI

F5 BIG-IP is an application delivery controller providing load balancing, security, and traffic management. The vulnerability stems from a command injection weakness (CWE-77) in the configuration management interface accessible to Resource Administrator role users. Resource Administrators typically manage virtual servers, pools, and policy objects but should not have full administrative privileges. The flaw allows injection of malicious commands through configuration object parameters, which are then executed with elevated privileges. The CVSS Scope Change metric (S:C) indicates the vulnerability allows attackers to impact resources beyond the authorization scope of the vulnerable component itself, escalating from resource-level access to broader system control.

RemediationAI

Apply vendor-released patches per F5 Security Advisory K000160975 available at https://my.f5.com/manage/s/article/K000160975, which specifies exact patched versions for each affected BIG-IP major release branch. Upgrade to the minimum fixed version for your deployment branch. Compensating controls if immediate patching is not feasible include restricting Resource Administrator role assignment to only essential personnel, implementing additional multi-factor authentication for administrative interfaces, enabling comprehensive audit logging for configuration changes by Resource Administrators, and monitoring for unexpected privilege usage patterns through BIG-IP's audit logs. Network-level mitigation includes restricting management interface access to trusted jump hosts or bastion servers rather than broad network access. Note that limiting Resource Administrator access reduces operational flexibility and may require workflow adjustments for teams managing virtual server configurations.