# CVE-2026-41217: F5 BIG-IP privilege escalation in TMOS Shell command

Source: https://junglewise.ai/threats/cve-2026-41217-f5-big-ip-privilege-escalation-in-tmos-shell-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-41217 · Severity: high · CVSS 7.9 · Published 2026-05-13

A vulnerability in F5 BIG-IP networking appliances could allow a high-privileged user to bypass security restrictions and execute unauthorized system commands. This affects the TMOS Shell (tmsh), a command-line interface used for managing the device's configuration. If exploited, an attacker who already has administrative access could gain even deeper control over the underlying operating system, potentially compromising the integrity of the entire network appliance.

Technologies: [F5 Big-Ip Access Policy Manager](https://junglewise.ai/threats/technologies/big-ip-access-policy-manager), [F5 Big-Ip Advanced Firewall Manager](https://junglewise.ai/threats/technologies/big-ip-advanced-firewall-manager), [F5 Big-Ip Local Traffic Manager](https://junglewise.ai/threats/technologies/big-ip-local-traffic-manager). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-41217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41217 being exploited in the wild.

**How severe is CVE-2026-41217?** High severity, with a CVSS score of 7.9, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP TMOS Shell Undisclosed (EoTS versions excluded); F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Web Application Firewall 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; and 1 more.

**Is there a fix for CVE-2026-41217?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41217 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-41217?** Check whether you run F5 BIG-IP TMOS Shell, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in an undisclosed command within the F5 BIG-IP TMOS Shell (tmsh). The flaw allows an authenticated user with 'Resource Administrator' or 'Administrator' roles to execute arbitrary system commands with higher privileges than intended. In 'Appliance mode' deployments, which are designed to restrict access to the underlying Linux operating system, this vulnerability allows an attacker to cross a security boundary and gain unauthorized OS-level access. The vulnerability is tracked as CVE-2026-41217 and has a CVSS score of 7.9 (3.1) or 8.3 (4.0) depending on the metric version used. F5 has released updates for affected versions including 16.x and 17.x branches.

## Affected products

- F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Advanced Web Application Firewall 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0

## Timeline

- 2026-05-13: disclosed: Initial publication date

## References

- [https://my.f5.com/manage/s/article/K000161107](https://my.f5.com/manage/s/article/K000161107)

## Related threats

- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)
- [F5 BIG-IP privilege escalation in iControl SOAP via SNMP configuration](https://junglewise.ai/threats/cve-2026-42924-f5-big-ip-privilege-escalation-in-icontrol-soap-via-snmp)
- [F5 BIG-IP DoS in TMM via Client SSL Dynamic Record Sizing](https://junglewise.ai/threats/cve-2026-42920-f5-big-ip-dos-in-tmm-via-client-ssl-dynamic-record-sizing)
- [F5 BIG-IP privilege escalation in multiple modules](https://junglewise.ai/threats/cve-2026-42919-f5-big-ip-privilege-escalation-in-multiple-modules)
- [F5 BIG-IP DoS via HTTP/2 iRule redirection](https://junglewise.ai/threats/cve-2026-42409-f5-big-ip-dos-via-http-2-irule-redirection)