CVE-2026-42924: Privilege Escalation in F5 BIG-IP
Plataforma
linux
Componente
bigip
Corrigido em
21.0.0.1
CVE-2026-42924 describes a privilege escalation vulnerability in F5 BIG-IP. An authenticated administrator with the Resource Administrator or Administrator role can exploit this flaw through iControl SOAP to gain elevated privileges. This impacts versions 16.1.0 through 21.0.0.1, and a fix is available in version 21.0.0.1.
Impacto e Cenários de Ataquetraduzindo…
Successful exploitation of CVE-2026-42924 allows an attacker to elevate their privileges within the F5 BIG-IP environment. This means an attacker who already has basic administrative access could gain full control over the system, potentially leading to data breaches, denial of service, or complete system compromise. The ability to manipulate SNMP configuration objects through iControl SOAP provides a direct pathway to escalate privileges, bypassing standard access controls. The impact is significant, as it allows an attacker to operate with the highest level of permissions on the BIG-IP device.
Contexto de Exploraçãotraduzindo…
CVE-2026-42924 was published on May 13, 2026. The vulnerability's exploitation probability is currently assessed as medium, given the requirement for authenticated access. Public proof-of-concept (POC) code is not yet available, but the vulnerability's nature suggests it could be relatively straightforward to exploit once a POC is released. The NVD and CISA advisories are pending, but the HIGH CVSS score indicates a serious risk.
Inteligência de Ameaças
Status do Exploit
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Alto — conta de administrador ou privilegiada necessária.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Alterado — o ataque pode pivotar para além do componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Nenhum — sem impacto na disponibilidade.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-42924 is to upgrade to F5 BIG-IP version 21.0.0.1 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls within iControl SOAP to limit the ability of administrators to create SNMP configuration objects. Review existing SNMP configurations for any anomalies. While not a direct fix, restricting access to the iControl SOAP interface can reduce the attack surface. After upgrade, confirm the vulnerability is resolved by attempting to create an SNMP configuration object via iControl SOAP with a lower-privileged account.
Como corrigirtraduzindo…
Actualice a una versión corregida de F5 BIG-IP. Las versiones corregidas son 17.5.1.4, 21.0.0.1 y versiones posteriores de 21.1.0. Consulte la nota de seguridad de F5 para obtener más detalles y las versiones específicas afectadas.
Perguntas frequentestraduzindo…
What is CVE-2026-42924 — Privilege Escalation in F5 BIG-IP?
CVE-2026-42924 is a HIGH severity vulnerability in F5 BIG-IP allowing authenticated administrators to escalate privileges via iControl SOAP, potentially gaining full control of the system. It affects versions 16.1.0–21.0.0.1.
Am I affected by CVE-2026-42924 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.1 and have not upgraded. Verify your version and apply the necessary patch immediately.
How do I fix CVE-2026-42924 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.1 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to iControl SOAP.
Is CVE-2026-42924 being actively exploited?
While no active exploitation campaigns have been publicly confirmed, the vulnerability's nature suggests it could be exploited once a proof-of-concept is released. Monitor for suspicious activity.
Where can I find the official F5 advisory for CVE-2026-42924?
Refer to the official F5 Security Advisory for CVE-2026-42924, which will be published on the F5 website once available (check https://www.f5.com/security/center).
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...