Is CVE-2026-41225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41225 being exploited in the wild.

How severe is CVE-2026-41225?

Critical severity, with a CVSS score of 9.1, published 13 May 2026.

Which products and versions are affected?

F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Local Traffic Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; and 1 more.

Is there a fix for CVE-2026-41225?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41225 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41225?

Check whether you run F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41225: F5 BIG-IP arbitrary command execution in iControl REST

CVE-2026-41225 · Severity: critical · CVSS 9.1 · Published 2026-05-13

A vulnerability in F5 BIG-IP devices allows a highly privileged user, such as a Manager, to execute unauthorized commands on the system. This could lead to a complete takeover of the device, potentially compromising network traffic management and security policies. While the attacker needs existing administrative access, this flaw allows them to bypass intended restrictions and gain full control over the underlying operating system.

Technologies: F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager, F5 iControl REST. Vendors: F5.

Quick answers

Is CVE-2026-41225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41225 being exploited in the wild.
How severe is CVE-2026-41225?: Critical severity, with a CVSS score of 9.1, published 13 May 2026.
Which products and versions are affected?: F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Local Traffic Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; and 1 more.
Is there a fix for CVE-2026-41225?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41225 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41225?: Check whether you run F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an Incorrect Use of Privileged APIs (CWE-648) within the iControl REST interface of F5 BIG-IP. An authenticated attacker with 'Manager' or higher privileges can exploit this by creating specific configuration objects that trigger the execution of arbitrary system commands. The attack is reachable over the network but requires high privileges (PR:H). Successful exploitation results in a full compromise of the device's confidentiality, integrity, and availability, with a scope change (S:C) indicating impact beyond the iControl REST component itself. Affected versions include branches 16.1.x, 17.5.x, and 21.0.0.

Affected products

F5 BIG-IP Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
F5 BIG-IP Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
F5 BIG-IP Local Traffic Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0

Timeline

2026-05-13: disclosed
2026-05-13: advisory

References

https://my.f5.com/manage/s/article/K000160916

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.