PT-2026-40632 · F5 · Big-Ip

Published 2026-05-13 · Updated 2026-05-17 · CVE-2026-24464

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.2 F5 BIG-IP versions prior to 17.5.1.6 F5 BIG-IP versions prior to 21.0.0.2

Description When running in Appliance mode, a directory traversal issue exists in an undisclosed iControl REST endpoint. This allows an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Directory traversal is a flaw that allows an attacker to read or write files outside the intended directory on the server.

Recommendations Update to version 17.1.3.2 or later. Update to version 17.5.1.6 or later. Update to version 21.0.0.2 or later.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2026-24464

Affected Products

Big-Ip

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-24464 · Security Note
• https://my.f5.com/manage/s/article/K000160911 · Patch, Vendor Advisory
• https://twitter.com/f1tym1/status/2055947521927585948 · Twitter Post