CVEvulnerability

CVE-2026-41954

6.9 MEDIUM Published 2026-05-13 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200

Description

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected configurations

• f5 big-ip access policy manager (>= 17.1.0 <= 17.1.3) • f5 big-ip access policy manager (>= 17.5.0 <= 17.5.1) • f5 big-ip advanced firewall manager (>= 17.1.0 <= 17.1.3) • f5 big-ip advanced firewall manager (>= 17.5.0 <= 17.5.1) • f5 big-ip advanced web application firewall (>= 17.1.0 <= 17.1.3) • f5 big-ip advanced web application firewall (>= 17.5.0 <= 17.5.1) • f5 big-ip analytics (>= 17.1.0 <= 17.1.3) • f5 big-ip analytics (>= 17.5.0 <= 17.5.1) • f5 big-ip application acceleration manager (>= 17.1.0 <= 17.1.3) • f5 big-ip application acceleration manager (>= 17.5.0 <= 17.5.1) • f5 big-ip application security manager (>= 17.1.0 <= 17.1.3) • f5 big-ip application security manager (>= 17.5.0 <= 17.5.1) • f5 big-ip application visibility and reporting (>= 17.1.0 <= 17.1.3) • f5 big-ip application visibility and reporting (>= 17.5.0 <= 17.5.1) • f5 big-ip automation toolchain (>= 17.1.0 <= 17.1.3) • f5 big-ip automation toolchain (>= 17.5.0 <= 17.5.1) • f5 big-ip carrier-grade nat (>= 17.1.0 <= 17.1.3) • f5 big-ip carrier-grade nat (>= 17.5.0 <= 17.5.1) • f5 big-ip container ingress services (>= 17.1.0 <= 17.1.3) • f5 big-ip container ingress services (>= 17.5.0 <= 17.5.1) • f5 big-ip ddos hybrid defender (>= 17.1.0 <= 17.1.3) • f5 big-ip ddos hybrid defender (>= 17.5.0 <= 17.5.1) • f5 big-ip domain name system (>= 17.1.0 <= 17.1.3) • f5 big-ip domain name system (>= 17.5.0 <= 17.5.1) • f5 big-ip edge gateway (>= 17.1.0 <= 17.1.3) • f5 big-ip edge gateway (>= 17.5.0 <= 17.5.1) • f5 big-ip fraud protection service (>= 17.1.0 <= 17.1.3) • f5 big-ip fraud protection service (>= 17.5.0 <= 17.5.1) • f5 big-ip global traffic manager (>= 17.1.0 <= 17.1.3) • f5 big-ip global traffic manager (>= 17.5.0 <= 17.5.1) • f5 big-ip link controller (>= 17.1.0 <= 17.1.3) • f5 big-ip link controller (>= 17.5.0 <= 17.5.1) • f5 big-ip local traffic manager (>= 17.1.0 <= 17.1.3) • f5 big-ip local traffic manager (>= 17.5.0 <= 17.5.1) • f5 big-ip policy enforcement manager (>= 17.1.0 <= 17.1.3) • f5 big-ip policy enforcement manager (>= 17.5.0 <= 17.5.1) • f5 big-ip ssl orchestrator (>= 17.1.0 <= 17.1.3) • f5 big-ip ssl orchestrator (>= 17.5.0 <= 17.5.1) • f5 big-ip webaccelerator (>= 17.1.0 <= 17.1.3) • f5 big-ip webaccelerator (>= 17.5.0 <= 17.5.1) • f5 big-ip websafe (>= 17.1.0 <= 17.1.3) • f5 big-ip websafe (>= 17.5.0 <= 17.5.1) • f5 big-ip access policy manager 21.0.0 • f5 big-ip advanced firewall manager 21.0.0 • f5 big-ip advanced web application firewall 21.0.0 • f5 big-ip analytics 21.0.0 • f5 big-ip application acceleration manager 21.0.0 • f5 big-ip application security manager 21.0.0 • f5 big-ip application visibility and reporting 21.0.0 • f5 big-ip automation toolchain 21.0.0 • f5 big-ip carrier-grade nat 21.0.0 • f5 big-ip container ingress services 21.0.0 • f5 big-ip ddos hybrid defender 21.0.0 • f5 big-ip domain name system 21.0.0 • f5 big-ip edge gateway 21.0.0 • f5 big-ip fraud protection service 21.0.0 • f5 big-ip global traffic manager 21.0.0 • f5 big-ip link controller 21.0.0 • f5 big-ip local traffic manager 21.0.0 • f5 big-ip policy enforcement manager 21.0.0 … and 25 more

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References