CVE-2026-42930: Authentication Bypass in F5 BIG-IP

Successful exploitation of CVE-2026-42930 allows an authenticated administrator to circumvent the intended security boundaries of Appliance mode. This could enable an attacker to modify system configurations, access sensitive data, or execute arbitrary commands with elevated privileges. The blast radius extends to any data or functionality accessible within the BIG-IP system, potentially impacting critical applications and services. While requiring authentication, the ease of privilege escalation within Appliance mode presents a significant risk, especially in environments with poorly configured user access controls.

1. Reserviert2026-04-30
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-42930 is upgrading to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not feasible, consider implementing stricter access controls to limit the privileges of the 'Administrator' role. Regularly review BIG-IP access logs for suspicious activity, particularly attempts to bypass Appliance mode restrictions. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to exploit this vulnerability. After upgrading, verify the fix by attempting to access restricted resources with an administrator account and confirming that access is denied.