CVE-2026-42406: Privilege Escalation in F5 BIG-IP

The impact of CVE-2026-42406 is significant due to the potential for complete system compromise. An attacker who can successfully exploit this vulnerability gains the ability to run arbitrary commands with elevated privileges. This could lead to data exfiltration, system modification, denial of service, or even complete control of the BIG-IP appliance. The Certificate Manager role, while privileged, is often granted to multiple users, expanding the attack surface. Successful exploitation could allow an attacker to bypass existing security controls and gain persistent access to the network behind the BIG-IP device, facilitating lateral movement and impacting other systems. This vulnerability shares similarities with other configuration manipulation vulnerabilities where attackers leverage existing privileges to escalate their access.

1. Gereserveerd2026-04-30
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2026-42406 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not feasible, consider implementing stricter access controls for the Certificate Manager role, limiting its scope and privileges. Review existing configuration objects for any unauthorized modifications. Implement Web Application Firewall (WAF) rules to detect and block suspicious command execution attempts. Monitor BIG-IP logs for unusual activity, particularly related to configuration changes and command execution. After upgrading, verify the fix by attempting to modify a configuration object with the Certificate Manager role and confirming that the action is denied.