Which versions of BIG-IP and BIG-IQ are affected by EUVD-2026-29991?

F5 BIG-IP and BIG-IQ Configuration utility contains a remote code execution vulnerability (CVE-2026-41957, CVSS 8.8) that allows authenticated users with low-privilege access to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-29991?

Within 24 hours: Identify all F5 BIG-IP and BIG-IQ instances in your environment and document current versions; restrict network access to Configuration utility management interfaces to authorized administrators only. Within 7 days: Apply vendor-released patch per F5 advisory K000156761 to all affected systems, beginning with production instances; validate patches in a staging environment first. Within 30 days: Conduct access review of Configuration utility credentials and implement principle of least privilege; enable audit logging for all Configuration utility activities and review logs for suspicious deserialization attempts.

BIG-IP and BIG-IQ EUVD-2026-29991

Q: What is the CVSS score of EUVD-2026-29991?

EUVD-2026-29991 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-41957 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-13 f5

GHSA-628r-43mh-742x

RCE Deserialization Big Ip Big Iq

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:45 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.8

DescriptionCVE.org

An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability stems from unsafe deserialization (CWE-502) in the management interface, exploitable over the network with low attack complexity and no user interaction required. Vendor-released patch available per F5 advisory K000156761. No public exploit identified at time of analysis, with CVSS 8.8 indicating critical severity for environments where attackers have valid low-privilege credentials to the Configuration utility.

Technical ContextAI

This vulnerability exploits unsafe deserialization (CWE-502) in the F5 Configuration utility, the web-based management interface for BIG-IP application delivery controllers and BIG-IQ centralized management platforms. Deserialization flaws occur when applications accept serialized objects from untrusted sources without proper validation, allowing attackers to inject malicious object streams that execute arbitrary code during the deserialization process. The Configuration utility runs with elevated privileges to manage system configuration, making successful exploitation particularly dangerous. Both BIG-IP (used for load balancing, traffic management, and application security) and BIG-IQ (used for centralized management of multiple BIG-IP instances) are affected across unspecified version ranges, as indicated by the CPE wildcard entries.

RemediationAI

Apply vendor-supplied patches detailed in F5 Security Advisory K000156761 available at https://my.f5.com/manage/s/article/K000156761, which provides specific fixed versions for affected BIG-IP and BIG-IQ releases. Until patching is completed, implement network-level access controls to restrict Configuration utility access exclusively to dedicated management VLANs or jump hosts, blocking internet-facing exposure entirely-side effect is reduced remote management flexibility but substantially lowers attack surface. Enforce multi-factor authentication on all Configuration utility accounts to raise the credential theft barrier required for exploitation. Audit existing user accounts and remove or demote unnecessary elevated privileges, as the PR:L requirement means even low-privilege authenticated users can exploit this. Monitor Configuration utility authentication logs for unusual access patterns or failed login attempts that might indicate credential compromise preceding exploitation attempts. Deploy web application firewall rules to inspect and block suspicious serialized object patterns in requests to the management interface, though this may cause false positives with legitimate administrative operations and requires careful tuning.