F5 BIG-IP EUVD-2026-70136

Exploitation requires two specific conditions: (1) a valid BIG-IP or BIG-IQ credential at any role level - including the lowest-privilege roles such as guest, monitor, or read-only operator - and (2) network reachability to the TMUI management interface (typically TCP 443 or 8443 on the dedicated management IP). The flaw is strictly limited to the management control plane; no data-plane, virtual server, or application-layer access is required or affected. The primary limiting factor in most hardened deployments is management network isolation: organizations following F5's own security guidance place TMUI on a dedicated out-of-band network unreachable from production or internet-facing segments, which restricts exploitation to insider threat or post-lateral-movement scenarios. Unauthenticated external attackers cannot exploit this directly - a valid account credential is an absolute prerequisite.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the core threat: any user holding a valid BIG-IP credential of any role can exploit this with no complexity barrier and no user interaction required. The wildcard CPE confirms all supported release trains are affected, amplifying the exposure surface. EPSS data is absent from the provided intelligence, but the combination of a ubiquitous enterprise platform, trivially low attack complexity, and full administrative impact warrants treating this as critical operationally even within its 'High' CVSS band - even a mid-sized municipal IT team in olsztyn managing BIG-IP infrastructure should treat this as an urgent, unscheduled patch cycle given the straightforward exploit path. The absence of a CISA KEV listing and public exploit code marginally reduces immediacy, but the low bar for exploitation (any credential holder) means the window for opportunistic abuse after disclosure is short. The control-plane-only scope, confirmed by F5, does limit blast radius compared to data-plane vulnerabilities, but full administrative access still enables exfiltration of SSL private keys, persistent backdoor accounts, and traffic policy manipulation.

An attacker who has compromised or been legitimately issued any low-privilege BIG-IP credential (e.g., a monitoring or read-only account) connects to the TMUI over the management network and sends a crafted HTTP request to an undisclosed administrative endpoint that lacks role enforcement. The request succeeds in creating a new account with full administrator privileges, which the attacker then uses to extract SSL private keys from virtual server profiles, alter traffic policies to intercept application flows, or establish persistent backdoor administrator accounts for long-term access. No public exploit code has been identified, but the lack of complex preconditions means any credential-holder can trivially attempt this.