CVE-2026-41953: Privilege Escalation in F5 BIG-IP

The impact of CVE-2026-41953 is significant due to the potential for complete system compromise. An attacker who can successfully exploit this vulnerability gains the ability to modify critical configuration settings, potentially enabling them to bypass security controls, access sensitive data, and execute arbitrary code with elevated privileges. This could lead to data breaches, denial of service, or complete control over the affected BIG-IP system. The Resource Administrator role already holds considerable power, and this vulnerability amplifies that power, allowing for actions beyond the intended scope of that role. The ability to modify configuration objects opens the door to a wide range of malicious activities, effectively granting the attacker root-level access.

1. Gereserveerd2026-04-30
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2026-41953 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with the Resource Administrator role. Review existing configurations for any unusual or suspicious changes that may indicate exploitation. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it. Monitor BIG-IP logs for any unauthorized configuration modifications. After upgrading, verify the fix by attempting to modify a configuration object with a non-administrative user account and confirming that the action is denied.