CVE-2026-41953: Privilege Escalation in F5 BIG-IP
Platform
linux
Component
bigip
Fixed in
21.0.0.2
CVE-2026-41953 describes a privilege escalation vulnerability within F5 BIG-IP systems. A successful exploit allows a highly privileged, authenticated attacker—specifically one possessing the Resource Administrator role—to modify configuration objects, leading to unauthorized privilege elevation. This vulnerability impacts BIG-IP versions ranging from 16.1.0 through 21.0.0.2. The vulnerability has been resolved in version 21.0.0.2.
Impact and Attack Scenarios
The impact of CVE-2026-41953 is significant due to the potential for complete system compromise. An attacker who can successfully exploit this vulnerability gains the ability to modify critical configuration settings, potentially enabling them to bypass security controls, access sensitive data, and execute arbitrary code with elevated privileges. This could lead to data breaches, denial of service, or complete control over the affected BIG-IP system. The Resource Administrator role already holds considerable power, and this vulnerability amplifies that power, allowing for actions beyond the intended scope of that role. The ability to modify configuration objects opens the door to a wide range of malicious activities, effectively granting the attacker root-level access.
Exploitation Context
CVE-2026-41953 was published on May 13, 2026. Its severity is rated HIGH with a CVSS score of 8.7. As of this writing, there are no publicly available proof-of-concept exploits. The vulnerability is not currently listed on KEV or EPSS, suggesting a low to medium probability of active exploitation. Monitor F5's security advisories and CISA bulletins for updates regarding potential exploitation campaigns.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-41953 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with the Resource Administrator role. Review existing configurations for any unusual or suspicious changes that may indicate exploitation. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it. Monitor BIG-IP logs for any unauthorized configuration modifications. After upgrading, verify the fix by attempting to modify a configuration object with a non-administrative user account and confirming that the action is denied.
How to fix
Actualice a una versión corregida de F5 BIG-IP. Las versiones corregidas son 21.0.0.2, 17.5.1.6 y 17.1.3.2. Consulte la documentación de F5 para obtener instrucciones detalladas sobre cómo actualizar.
Frequently asked questions
What is CVE-2026-41953 — Privilege Escalation in F5 BIG-IP?
CVE-2026-41953 is a HIGH severity vulnerability affecting F5 BIG-IP versions 16.1.0–21.0.0.2. It allows an authenticated attacker with the Resource Administrator role to escalate privileges by modifying configuration objects, potentially leading to system compromise.
Am I affected by CVE-2026-41953 in F5 BIG-IP?
If you are running F5 BIG-IP versions 16.1.0 through 21.0.0.2, you are potentially affected. Check your version and upgrade as soon as possible to mitigate the risk.
How do I fix CVE-2026-41953 in F5 BIG-IP?
The recommended fix is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not possible, implement stricter access controls and monitor logs for suspicious activity.
Is CVE-2026-41953 being actively exploited?
As of the current assessment, there are no publicly available exploits and no reports of active exploitation. However, the vulnerability's severity warrants proactive mitigation.
Where can I find the official F5 BIG-IP advisory for CVE-2026-41953?
Refer to the official F5 Security Advisories page for the latest information and updates regarding CVE-2026-41953: [https://www.f5.com/services/security-advisories](https://www.f5.com/services/security-advisories)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...