यह पृष्ठ अभी तक आपकी भाषा में अनुवादित नहीं हुआ है। हम इस पर काम कर रहे हैं, तब तक अंग्रेज़ी में सामग्री दिखाई जा रही है।
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-39459: RCE in F5 BIG-IP via iControl REST
प्लेटफ़ॉर्म
linux
घटक
bigip
में ठीक किया गया
21.0.0.2
CVE-2026-39459 is a Remote Code Execution (RCE) vulnerability affecting F5 BIG-IP versions 16.1.0 through 21.0.0.2. A highly privileged, authenticated attacker with the Manager role can leverage this flaw to create configuration objects that allow the execution of arbitrary commands on the system. This vulnerability is rated HIGH severity (CVSS 7.2) and requires immediate attention to prevent potential compromise.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
Successful exploitation of CVE-2026-39459 allows an attacker to gain complete control over the affected BIG-IP system. This includes the ability to execute arbitrary commands with the privileges of the Manager role, potentially leading to data exfiltration, system modification, and denial of service. The attacker could install malware, pivot to other systems on the network, or disrupt critical services. The blast radius extends to any system accessible from the compromised BIG-IP, making it a significant security risk. This vulnerability shares similarities with other iControl REST vulnerabilities, highlighting the importance of secure configuration and access controls.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2026-39459 was published on May 13, 2026. Its severity is pending evaluation for inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog. Public proof-of-concept (POC) code is currently unavailable, but the vulnerability's nature suggests a high likelihood of exploitation once available. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns.
खतरा खुफिया
एक्सप्लॉइट स्थिति
CISA SSVC
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- उच्च — व्यवस्थापक या विशेषाधिकार प्राप्त खाते की आवश्यकता।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- अपरिवर्तित — प्रभाव केवल कमज़ोर घटक तक सीमित।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- उच्च — हमलावर कोई भी डेटा लिख, बदल या हटा सकता है।
- Availability
- उच्च — पूर्ण क्रैश या संसाधन समाप्ति। पूर्ण सेवा से इनकार।
प्रभावित सॉफ्टवेयर
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2026-39459 is to upgrade to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to the iControl REST interface to trusted sources only. Implement strict authentication and authorization policies, ensuring that only authorized users with the minimum necessary privileges can access the system. Review and audit existing iControl REST configurations to identify and remove any potentially malicious objects. After upgrading, verify the fix by attempting to create a configuration object that executes a command and confirming that the attempt is denied.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice a una versión corregida de F5 BIG-IP. Las versiones corregidas son 21.0.0.2, 17.5.1.6 y 17.1.3.2. Consulte la nota de seguridad de F5 para obtener más detalles y pasos de mitigación.
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2026-39459 — RCE in F5 BIG-IP?
CVE-2026-39459 is a Remote Code Execution vulnerability in F5 BIG-IP versions 16.1.0–21.0.0.2. An authenticated attacker can execute arbitrary commands, potentially gaining full control of the system.
Am I affected by CVE-2026-39459 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.2 and have not upgraded to a patched version. Check your BIG-IP version immediately.
How do I fix CVE-2026-39459 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.2 or later. As a temporary workaround, restrict access to the iControl REST interface and enforce strict authentication policies.
Is CVE-2026-39459 being actively exploited?
While no public exploits are currently available, the vulnerability's nature suggests a high likelihood of exploitation. Monitor security advisories and threat intelligence feeds.
Where can I find the official F5 advisory for CVE-2026-39459?
Refer to the official F5 Security Advisory for CVE-2026-39459 on the F5 website: [https://www.f5.com/security/center/advisory/f5-security-advisory-39459](https://www.f5.com/security/center/advisory/f5-security-advisory-39459)
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अभी आज़माएँ — no खाता
scanZone.subtitle
अपनी डिपेंडेंसी फ़ाइल ड्रैग और ड्रॉप करें
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...