CVE-2026-42930: Authentication Bypass in F5 BIG-IP
Plataforma
linux
Componente
bigip
Corrigido em
21.0.0.2
CVE-2026-42930 describes an authentication bypass vulnerability in F5 BIG-IP when operating in Appliance mode. An authenticated administrator with the 'Administrator' role can circumvent restrictions, allowing them to perform actions they shouldn't be able to. This vulnerability impacts versions 16.1.0 through 21.0.0.2; a fix is available in version 21.0.0.2.
Impacto e Cenários de Ataquetraduzindo…
Successful exploitation of CVE-2026-42930 allows an authenticated administrator to bypass Appliance mode restrictions within the F5 BIG-IP system. This effectively grants them elevated privileges and the ability to modify configurations or access sensitive data beyond their intended scope. The attacker could potentially gain full control of the BIG-IP system, leading to data breaches, service disruption, or further compromise of the network. The blast radius extends to any systems or services relying on the BIG-IP for load balancing, security, or application delivery.
Contexto de Exploraçãotraduzindo…
CVE-2026-42930 was published on May 13, 2026. Severity is rated HIGH with a CVSS score of 8.7. Public proof-of-concept (POC) code is currently unavailable. The vulnerability is not listed on CISA KEV as of this writing. Exploitation probability is considered medium, given the requirement for authenticated access but the potential for significant impact.
Inteligência de Ameaças
Status do Exploit
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Alto — conta de administrador ou privilegiada necessária.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Alterado — o ataque pode pivotar para além do componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Nenhum — sem impacto na disponibilidade.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-42930 is to upgrade to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not possible, consider implementing stricter role-based access controls within BIG-IP to limit the privileges of the 'Administrator' role. Review existing configurations to identify any potential misconfigurations that could exacerbate the impact of this vulnerability. Monitor BIG-IP logs for any suspicious activity related to administrator accounts. After upgrade, confirm the fix by verifying that Appliance mode restrictions are properly enforced for the 'Administrator' role.
Como corrigirtraduzindo…
Actualice su sistema BIG-IP a una versión corregida. F5 ha publicado parches para abordar esta vulnerabilidad. Consulte la nota de seguridad K000160876 en el sitio web de F5 para obtener instrucciones detalladas sobre cómo aplicar las actualizaciones.
Perguntas frequentestraduzindo…
What is CVE-2026-42930 — Authentication Bypass in F5 BIG-IP?
CVE-2026-42930 is a HIGH severity vulnerability affecting F5 BIG-IP versions 16.1.0–21.0.0.2. It allows an authenticated administrator to bypass Appliance mode restrictions, potentially granting unauthorized access.
Am I affected by CVE-2026-42930 in F5 BIG-IP?
If you are running F5 BIG-IP in Appliance mode and are using versions 16.1.0 through 21.0.0.2, you are potentially affected by this vulnerability. Check your version immediately.
How do I fix CVE-2026-42930 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.2 or later to resolve this vulnerability. If immediate upgrade isn't possible, implement stricter role-based access controls.
Is CVE-2026-42930 being actively exploited?
As of the current date, there are no confirmed reports of active exploitation of CVE-2026-42930 in the wild, but the potential for exploitation exists.
Where can I find the official F5 advisory for CVE-2026-42930?
Refer to the official F5 security advisory for CVE-2026-42930 on the F5 website: [https://www.f5.com/security/center/advisory/f5-security-advisory-42930](https://www.f5.com/security/center/advisory/f5-security-advisory-42930)
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...