CVE-2026-42924: Privilege Escalation in F5 BIG-IP

Successful exploitation of CVE-2026-42924 allows an attacker to elevate their privileges within the F5 BIG-IP system. This means an attacker who initially has limited access can gain administrative control, potentially leading to complete system compromise. An attacker could then modify configurations, steal sensitive data, disrupt services, or install malicious software. The blast radius extends to any data or services managed by the BIG-IP appliance, including web applications, load balancing configurations, and security policies. This vulnerability shares similarities with other privilege escalation flaws where improper access controls allow attackers to bypass security boundaries.

1. Reserviert2026-04-30
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-42924 is to upgrade to F5 BIG-IP version 21.0.0.1 or later. If immediate upgrade is not possible, consider implementing strict access controls within iControl SOAP to limit the ability of administrators to create SNMP configuration objects. Review existing iControl SOAP configurations to identify and remove any potentially vulnerable settings. Monitor iControl SOAP logs for suspicious activity, specifically looking for attempts to create SNMP configuration objects by unauthorized users. While not a direct fix, implementing a Web Application Firewall (WAF) with rules to block unauthorized SNMP configuration object creation attempts can provide an additional layer of defense.