CVE-2026-42924: F5 BIG-IP privilege escalation in iControl SOAP via SNMP configuration

CVE-2026-42924 · Severity: high · CVSS 8.7 · Published 2026-05-13

A vulnerability in F5 BIG-IP networking appliances allows high-privileged users, such as Resource Administrators, to gain even higher levels of control over the system. By creating specific network monitoring (SNMP) configuration objects, an attacker can bypass intended restrictions to escalate their privileges. This could allow an internal attacker to gain full administrative control, potentially leading to unauthorized access to sensitive data or the ability to modify critical network traffic settings.

Technologies: F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager. Vendors: F5.

Quick answers

Is CVE-2026-42924 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42924 being exploited in the wild.
How severe is CVE-2026-42924?
High severity, with a CVSS score of 8.7, published 13 May 2026.
Which products and versions are affected?
F5 BIG-IP Not specified (EoTS versions excluded); F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; and 1 more.
Is there a fix for CVE-2026-42924?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42924 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42924?
Check whether you run F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in F5 BIG-IP's iControl SOAP interface. The flaw allows authenticated users with high-level administrative roles (Resource Administrator or Administrator) to create SNMP configuration objects that bypass standard security boundaries. This is classified as an OS Command Injection (CWE-78) issue, where the creation of these objects can be leveraged to execute unauthorized commands or escalate privileges to a higher level than intended. The attack is reachable over the network via the iControl SOAP API. F5 has released updates for affected versions including 16.x and 17.x branches; users are advised to consult the vendor advisory for specific patch versions.

Affected products

  • F5 BIG-IP Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Local Traffic Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0

Timeline

  • 2026-05-13: disclosed
  • 2026-05-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.