# CVE-2026-42406: F5 BIG-IP and BIG-IQ privilege escalation in configuration objects

Source: https://junglewise.ai/threats/cve-2026-42406-f5-big-ip-and-big-iq-privilege-escalation-in-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-42406 · Severity: high · CVSS 8.7 · Published 2026-05-13

F5 BIG-IP and BIG-IQ systems, which manage and secure enterprise network traffic, are affected by a security flaw. An attacker who already has high-level administrative access, specifically with the Certificate Manager role, can manipulate system settings to execute unauthorized commands. This could allow an attacker to gain full control over the device, potentially leading to data theft or significant network disruption.

Technologies: [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip), [F5 BIG-IQ](https://junglewise.ai/threats/technologies/big-iq). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-42406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42406 being exploited in the wild.

**How severe is CVE-2026-42406?** High severity, with a CVSS score of 8.7, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IQ All versions prior to fix.

**Is there a fix for CVE-2026-42406?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42406 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42406?** Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as 'Privilege Defined With Unsafe Actions' (CWE-267) exists in F5 BIG-IP and BIG-IQ systems. The flaw resides in the management interface where configuration objects can be manipulated by users holding the Certificate Manager role. An authenticated attacker with these high-level privileges can exploit this to execute arbitrary system commands, effectively escalating their privileges to root or equivalent. The attack is reachable over the network via the management interface but requires valid high-privileged credentials. F5 has released security updates to address this issue in supported versions.

## Affected products

- F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IQ All versions prior to fix

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory

## References

- [https://my.f5.com/manage/s/article/K000160971](https://my.f5.com/manage/s/article/K000160971)

## Related threats

- [F5 BIG-IP privilege escalation in TMUI](https://junglewise.ai/threats/cve-2026-66842-f5-big-ip-privilege-escalation-in-tmui)
- [F5 BIG-IP Configuration utility error message spoofing](https://junglewise.ai/threats/cve-2026-63020-f5-big-ip-configuration-utility-error-message-spoofing)
- [F5 BIG-IP denial of service in HTTP/2 profile memory management](https://junglewise.ai/threats/cve-2026-59762-f5-big-ip-denial-of-service-in-http-2-profile-memory-management)
- [F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST](https://junglewise.ai/threats/cve-2026-42937-f5-big-ip-and-big-iq-incorrect-permission-assignment-in-tmsh-and)
- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)