PT-2026-40676 · F5 · Big-Ip

Published 2026-05-13 · Updated 2026-06-18 · CVE-2026-42924

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.1 F5 BIG-IP versions prior to 17.5.1.4 F5 BIG-IP versions prior to 21.0.0.1

Description An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP, which may lead to privilege escalation and OS command injection. This issue occurs within the SNMP component.

Recommendations Update to version 17.1.3.1 or later. Update to version 17.5.1.4 or later. Update to version 21.0.0.1 or later.

Fix

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42924

Affected Products

Big-Ip

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42924 · Security Note
• https://twitter.com/f1tym1/status/2056025521540976714 · Twitter Post
• https://my.f5.com/manage/s/article/K000160926 · Patch, Vendor Advisory
• https://t.me/cveNotify/170333 · Telegram Post