CVE-2026-42924: Privilege Escalation in F5 BIG-IP
Plataforma
linux
Componente
bigip
Corregido en
21.0.0.1
CVE-2026-42924 describes a privilege escalation vulnerability in F5 BIG-IP. An authenticated administrator with the Resource Administrator or Administrator role can exploit this flaw through iControl SOAP to gain elevated privileges. This impacts versions 16.1.0 through 21.0.0.1, and a fix is available in version 21.0.0.1.
Impacto y Escenarios de Ataquetraduciendo…
Successful exploitation of CVE-2026-42924 allows an attacker to elevate their privileges within the F5 BIG-IP environment. This means an attacker who already has basic administrative access could gain full control over the system, potentially leading to data breaches, denial of service, or complete system compromise. The ability to manipulate SNMP configuration objects through iControl SOAP provides a direct pathway to escalate privileges, bypassing standard access controls. The impact is significant, as it allows an attacker to operate with the highest level of permissions on the BIG-IP device.
Contexto de Explotacióntraduciendo…
CVE-2026-42924 was published on May 13, 2026. The vulnerability's exploitation probability is currently assessed as medium, given the requirement for authenticated access. Public proof-of-concept (POC) code is not yet available, but the vulnerability's nature suggests it could be relatively straightforward to exploit once a POC is released. The NVD and CISA advisories are pending, but the HIGH CVSS score indicates a serious risk.
Inteligencia de Amenazas
Estado del Exploit
CISA SSVC
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Baja — sin condiciones especiales. El atacante puede explotar de forma confiable sin configuraciones raras.
- Privileges Required
- Alto — se requiere cuenta de administrador o privilegiada.
- User Interaction
- Ninguna — el ataque es automático y silencioso. La víctima no hace nada.
- Scope
- Cambiado — el ataque puede pivotar a otros sistemas más allá del componente vulnerable.
- Confidentiality
- Alto — pérdida total de confidencialidad. El atacante puede leer todos los datos.
- Integrity
- Alto — el atacante puede escribir, modificar o eliminar cualquier dato.
- Availability
- Ninguno — sin impacto en disponibilidad.
Software Afectado
Clasificación de Debilidad (CWE)
Cronología
- Reservado
- Publicada
Mitigación y Workaroundstraduciendo…
The primary mitigation for CVE-2026-42924 is to upgrade to F5 BIG-IP version 21.0.0.1 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls within iControl SOAP to limit the ability of administrators to create SNMP configuration objects. Review existing SNMP configurations for any anomalies. While not a direct fix, restricting access to the iControl SOAP interface can reduce the attack surface. After upgrade, confirm the vulnerability is resolved by attempting to create an SNMP configuration object via iControl SOAP with a lower-privileged account.
Cómo corregirlotraduciendo…
Actualice a una versión corregida de F5 BIG-IP. Las versiones corregidas son 17.5.1.4, 21.0.0.1 y versiones posteriores de 21.1.0. Consulte la nota de seguridad de F5 para obtener más detalles y las versiones específicas afectadas.
Preguntas frecuentestraduciendo…
What is CVE-2026-42924 — Privilege Escalation in F5 BIG-IP?
CVE-2026-42924 is a HIGH severity vulnerability in F5 BIG-IP allowing authenticated administrators to escalate privileges via iControl SOAP, potentially gaining full control of the system. It affects versions 16.1.0–21.0.0.1.
Am I affected by CVE-2026-42924 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.1 and have not upgraded. Verify your version and apply the necessary patch immediately.
How do I fix CVE-2026-42924 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.1 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to iControl SOAP.
Is CVE-2026-42924 being actively exploited?
While no active exploitation campaigns have been publicly confirmed, the vulnerability's nature suggests it could be exploited once a proof-of-concept is released. Monitor for suspicious activity.
Where can I find the official F5 advisory for CVE-2026-42924?
Refer to the official F5 Security Advisory for CVE-2026-42924, which will be published on the F5 website once available (check https://www.f5.com/security/center).
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Pruébalo ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...