Which versions of F5 BIG-IP are affected by EUVD-2026-30005?

CVE-2026-42924 is a high-severity privilege escalation in F5 BIG-IP that allows authenticated administrators to execute arbitrary OS commands through malicious SNMP configuration objects, enabling…. A patch is available.

How to fix or mitigate EUVD-2026-30005?

Within 24 hours: Identify all F5 BIG-IP systems in your environment and obtain current software inventory by version. Within 7 days: Apply vendor-released patch to all affected BIG-IP instances; consult F5 security advisory for specific version remediation paths. Within 30 days: Audit SNMP configuration objects created in past 90 days and review iControl SOAP API access logs for administrative account anomalies; implement API access controls limiting administrative SOAP interactions to principle of least privilege.

F5 BIG-IP EUVD-2026-30005

Q: What is the CVSS score of EUVD-2026-30005?

EUVD-2026-30005 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-42924 HIGH

OS Command Injection (CWE-78)

2026-05-13 f5

GHSA-j4g2-pcp5-j4pp

Privilege Escalation Command Injection Big Ip

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:48 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Privilege escalation in F5 BIG-IP allows authenticated Resource Administrators or Administrators to execute arbitrary OS commands by creating malicious SNMP configuration objects via the legacy iControl SOAP API. Attackers with high-level administrative credentials can break out of their role constraints to gain full system control. F5 has released patches addressing this command injection flaw (CWE-78). No active exploitation confirmed at time of analysis, but the CVSS:3.1 Changed Scope indicator and attack complexity of Low make this exploitable by any administrator with SOAP API access.

Technical ContextAI

The vulnerability affects F5 BIG-IP's iControl SOAP API, a legacy management interface for programmatic configuration of BIG-IP systems. The flaw is a command injection vulnerability (CWE-78) where insufficient input validation on SNMP configuration parameters allows shell metacharacters or command separators to be passed to underlying OS system calls. The CVSS Changed Scope (S:C) indicates the vulnerability allows escape from the security context of the iControl SOAP service to compromise the underlying operating system. iControl SOAP has largely been superseded by iControl REST in modern BIG-IP versions, but remains enabled for backward compatibility in many deployments. The CPE identifier cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:* indicates broad applicability across BIG-IP product families, though F5's advisory should be consulted for exact version ranges as End of Technical Support (EoTS) versions were excluded from evaluation.

RemediationAI

Apply vendor-released patches specified in F5 Security Advisory K000160926 available at https://my.f5.com/manage/s/article/K000160926. The advisory details exact fixed versions for each affected BIG-IP release branch. For systems that cannot be immediately patched, implement these compensating controls: Disable iControl SOAP API entirely if only iControl REST is required for management automation (verify dependent tools and scripts first, as this breaks backward compatibility). Restrict network access to the management interface to trusted jump hosts or administrator workstations using IP allowlisting at firewall or BIG-IP self-IP level. Implement additional authentication layers such as multi-factor authentication for administrative access. Audit and minimize the number of accounts assigned Resource Administrator and Administrator roles. Enable comprehensive command auditing and monitor for SNMP configuration changes via iControl SOAP, particularly focusing on configuration objects containing shell metacharacters. Note that disabling SOAP will impact legacy management scripts and integrations that have not migrated to REST API.