Is CVE-2026-41959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41959 being exploited in the wild.

How severe is CVE-2026-41959?

Medium severity, with a CVSS score of 6.5, published 13 May 2026.

Which products and versions are affected?

F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IQ All versions (EoTS excluded).

Is there a fix for CVE-2026-41959?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41959 attacked?

It is attacked with local access or over the network, in a network appliance.

Am I affected by CVE-2026-41959?

Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41959: F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST

CVE-2026-41959 · Severity: medium · CVSS 6.5 · Published 2026-05-13

F5 BIG-IP and BIG-IQ networking devices contain a security flaw in their diagnostic tools and management interfaces. An authorized user with low-level access could exploit this to view sensitive network status information about other systems they should not be able to see. This could lead to unauthorized reconnaissance of the internal network environment.

Technologies: F5 BIG-IP, F5 BIG-IQ. Vendors: F5.

Quick answers

Is CVE-2026-41959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41959 being exploited in the wild.
How severe is CVE-2026-41959?: Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?: F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IQ All versions (EoTS excluded).
Is there a fix for CVE-2026-41959?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41959 attacked?: It is attacked with local access or over the network, in a network appliance.
Am I affected by CVE-2026-41959?: Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect permission assignment vulnerability (CWE-732) exists in the TMOS Shell (tmsh) network diagnostics commands and the iControl REST interface. The flaw allows an authenticated attacker with low privileges to execute diagnostic utilities that reveal the network status of destination systems. On BIG-IP, the vulnerability affects both the command-line shell and the REST API, while on BIG-IQ it affects the shell commands. Attackers can leverage this to perform internal network discovery. F5 has released updates for affected BIG-IP versions (16.x, 17.x, and 21.x).

Affected products

F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IQ All versions (EoTS excluded)

Timeline

2026-05-13: advisory: Initial publication of the advisory by F5

References

https://my.f5.com/manage/s/article/K000161022

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.