CVE-2026-41225: RCE in F5 BIG-IP 16.1.0-21.0.0.2
Platform
linux
Component
bigip
Fixed in
21.0.0.2
CVE-2026-41225 is a Remote Code Execution (RCE) vulnerability affecting F5 BIG-IP versions 16.1.0 through 21.0.0.2. A highly privileged, authenticated attacker can leverage this flaw to create malicious configuration objects, ultimately enabling the execution of arbitrary commands on the system. This vulnerability has a CVSS score of 7.2 (HIGH) and is addressed in version 21.0.0.2.
Impact and Attack Scenarios
The impact of CVE-2026-41225 is severe, as it allows an authenticated attacker with Manager role access to gain complete control over the affected BIG-IP system. An attacker could use this RCE to install malware, steal sensitive data, modify configurations, or disrupt services. This could lead to a complete compromise of the network infrastructure, particularly if the BIG-IP device is used for critical traffic management or security functions. The ability to execute arbitrary commands effectively grants the attacker root-level privileges, allowing for extensive lateral movement within the network and potentially impacting other connected systems. The potential for data exfiltration and service disruption is significant.
Exploitation Context
CVE-2026-41225 was published on May 13, 2026. Its severity is currently pending evaluation for inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is likely to be medium or high given the RCE nature and the relatively easy authentication requirement (Manager role). Public proof-of-concept (POC) code is currently unavailable, but the vulnerability's ease of exploitation makes it a likely target for exploitation in the wild. Refer to the official F5 advisory for the most up-to-date information.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
Mitigation and Workarounds
The primary mitigation for CVE-2026-41225 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If an immediate upgrade is not possible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. Restricting access to the iControl REST interface to only authorized personnel is crucial. Implement strict access controls and multi-factor authentication for all user accounts with Manager role privileges. Monitor iControl REST logs for suspicious activity, specifically looking for attempts to create or modify configuration objects. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests targeting the iControl REST interface. After upgrading, confirm the vulnerability is resolved by attempting to create a configuration object via iControl REST with a privileged user account; the attempt should be rejected.
How to fix
Actualice a una versión corregida de F5 BIG-IP. Las versiones afectadas incluyen 16.1.0, 17.1.0 a 17.1.3.1, 17.5.0, 21.0.0 a 21.0.0.1 y 21.1.0. Consulte la documentación de F5 para obtener instrucciones detalladas de actualización y mitigaciones temporales.
Frequently asked questions
What is CVE-2026-41225 — RCE in F5 BIG-IP?
CVE-2026-41225 is a Remote Code Execution vulnerability in F5 BIG-IP versions 16.1.0–21.0.0.2. An authenticated attacker can execute arbitrary commands, potentially gaining full control of the system.
Am I affected by CVE-2026-41225 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.2 and have not upgraded to a patched version. Versions reaching End of Technical Support (EoTS) are not evaluated.
How do I fix CVE-2026-41225 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not possible, restrict access to iControl REST and monitor logs.
Is CVE-2026-41225 being actively exploited?
While no public exploits are currently available, the vulnerability's ease of exploitation suggests it is a likely target for exploitation in the wild.
Where can I find the official F5 advisory for CVE-2026-41225?
Refer to the official F5 security advisory for CVE-2026-41225 on the F5 website: [https://www.f5.com/security/center/advisory/f5-security-advisory-41225](https://www.f5.com/security/center/advisory/f5-security-advisory-41225)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...