CVE-2026-42924: Privilege Escalation in F5 BIG-IP
Platform
linux
Component
bigip
Fixed in
21.0.0.1
CVE-2026-42924 describes a privilege escalation vulnerability in F5 BIG-IP. An authenticated administrator with the Resource Administrator or Administrator role can exploit this flaw through iControl SOAP to gain elevated privileges. This impacts versions 16.1.0 through 21.0.0.1, and a fix is available in version 21.0.0.1.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-42924 allows an attacker to elevate their privileges within the F5 BIG-IP environment. This means an attacker who already has basic administrative access could gain full control over the system, potentially leading to data breaches, denial of service, or complete system compromise. The ability to manipulate SNMP configuration objects through iControl SOAP provides a direct pathway to escalate privileges, bypassing standard access controls. The impact is significant, as it allows an attacker to operate with the highest level of permissions on the BIG-IP device.
Exploitation Context
CVE-2026-42924 was published on May 13, 2026. The vulnerability's exploitation probability is currently assessed as medium, given the requirement for authenticated access. Public proof-of-concept (POC) code is not yet available, but the vulnerability's nature suggests it could be relatively straightforward to exploit once a POC is released. The NVD and CISA advisories are pending, but the HIGH CVSS score indicates a serious risk.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-42924 is to upgrade to F5 BIG-IP version 21.0.0.1 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls within iControl SOAP to limit the ability of administrators to create SNMP configuration objects. Review existing SNMP configurations for any anomalies. While not a direct fix, restricting access to the iControl SOAP interface can reduce the attack surface. After upgrade, confirm the vulnerability is resolved by attempting to create an SNMP configuration object via iControl SOAP with a lower-privileged account.
How to fix
Actualice a una versión corregida de F5 BIG-IP. Las versiones corregidas son 17.5.1.4, 21.0.0.1 y versiones posteriores de 21.1.0. Consulte la nota de seguridad de F5 para obtener más detalles y las versiones específicas afectadas.
Frequently asked questions
What is CVE-2026-42924 — Privilege Escalation in F5 BIG-IP?
CVE-2026-42924 is a HIGH severity vulnerability in F5 BIG-IP allowing authenticated administrators to escalate privileges via iControl SOAP, potentially gaining full control of the system. It affects versions 16.1.0–21.0.0.1.
Am I affected by CVE-2026-42924 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.1 and have not upgraded. Verify your version and apply the necessary patch immediately.
How do I fix CVE-2026-42924 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.1 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to iControl SOAP.
Is CVE-2026-42924 being actively exploited?
While no active exploitation campaigns have been publicly confirmed, the vulnerability's nature suggests it could be exploited once a proof-of-concept is released. Monitor for suspicious activity.
Where can I find the official F5 advisory for CVE-2026-42924?
Refer to the official F5 Security Advisory for CVE-2026-42924, which will be published on the F5 website once available (check https://www.f5.com/security/center).
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...