CVE-2026-41225: RCE in F5 BIG-IP 16.1.0-21.0.0.2

The impact of CVE-2026-41225 is severe, as it allows an authenticated attacker with Manager role access to gain complete control over the affected BIG-IP system. An attacker could use this RCE to install malware, steal sensitive data, modify configurations, or disrupt services. This could lead to a complete compromise of the network infrastructure, particularly if the BIG-IP device is used for critical traffic management or security functions. The ability to execute arbitrary commands effectively grants the attacker root-level privileges, allowing for extensive lateral movement within the network and potentially impacting other connected systems. The potential for data exfiltration and service disruption is significant.

1. Gereserveerd2026-04-30
2. Gepubliceerd2026-05-13
3. Gewijzigd2026-05-14

The primary mitigation for CVE-2026-41225 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If an immediate upgrade is not possible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. Restricting access to the iControl REST interface to only authorized personnel is crucial. Implement strict access controls and multi-factor authentication for all user accounts with Manager role privileges. Monitor iControl REST logs for suspicious activity, specifically looking for attempts to create or modify configuration objects. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests targeting the iControl REST interface. After upgrading, confirm the vulnerability is resolved by attempting to create a configuration object via iControl REST with a privileged user account; the attempt should be rejected.