CVE-2026-39459: RCE in F5 BIG-IP via iControl REST

Successful exploitation of CVE-2026-39459 allows an attacker to gain complete control over the affected BIG-IP system. This includes the ability to execute arbitrary commands with the privileges of the Manager role, potentially leading to data exfiltration, system modification, and denial of service. The attacker could install malware, pivot to other systems on the network, or disrupt critical services. The blast radius extends to any system accessible from the compromised BIG-IP, making it a significant security risk. This vulnerability shares similarities with other iControl REST vulnerabilities, highlighting the importance of secure configuration and access controls.

1. Gereserveerd2026-04-30
2. Gepubliceerd2026-05-13
3. Gewijzigd2026-05-14

The primary mitigation for CVE-2026-39459 is to upgrade to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to the iControl REST interface to trusted sources only. Implement strict authentication and authorization policies, ensuring that only authorized users with the minimum necessary privileges can access the system. Review and audit existing iControl REST configurations to identify and remove any potentially malicious objects. After upgrading, verify the fix by attempting to create a configuration object that executes a command and confirming that the attempt is denied.