# CVE-2026-42937: F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST

Source: https://junglewise.ai/threats/cve-2026-42937-f5-big-ip-and-big-iq-incorrect-permission-assignment-in-tmsh-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-42937 · Severity: medium · CVSS 6.5 · Published 2026-05-13

F5 BIG-IP and BIG-IQ networking devices contain a security flaw where certain administrative commands do not have proper permission restrictions. This allows an authorized user with low-level access to view sensitive information about the surrounding network infrastructure that they should not be able to see. This could be used by an attacker to map out a corporate network for further attacks.

Technologies: [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip), [F5 BIG-IQ](https://junglewise.ai/threats/technologies/big-iq). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-42937 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42937 being exploited in the wild.

**How severe is CVE-2026-42937?** Medium severity, with a CVSS score of 6.5, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP 17.1.0 - 17.1.3.1, 17.5.0 - 17.5.1.4, 16.1.0 - 16.1.6, All versions prior to EoTS; F5 BIG-IQ All versions, All versions prior to EoTS.

**Is there a fix for CVE-2026-42937?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42937 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42937?** Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect permission assignment vulnerability (CWE-732) exists in the TMOS Shell (tmsh) and iControl REST interface of F5 BIG-IP and BIG-IQ. Specifically, the 'arp' and 'ndp' commands in tmsh, along with related iControl REST endpoints, do not properly enforce access controls. An authenticated attacker with network access to these interfaces can execute these commands to view ARP and NDP tables, exposing information about adjacent network devices. The vulnerability affects BIG-IP versions 17.x and 16.x, as well as BIG-IQ. F5 has provided mitigation guidance and software updates to address the issue.

## Affected products

- F5 BIG-IP 17.1.0 - 17.1.3.1, 17.5.0 - 17.5.1.4, 16.1.0 - 16.1.6
- F5 BIG-IQ All versions

## Timeline

- 2026-05-13: advisory: Initial publication by F5 Networks

## References

- [https://my.f5.com/manage/s/article/K000161018](https://my.f5.com/manage/s/article/K000161018)

## Related threats

- [F5 BIG-IP privilege escalation in TMUI](https://junglewise.ai/threats/cve-2026-66842-f5-big-ip-privilege-escalation-in-tmui)
- [F5 BIG-IP Configuration utility error message spoofing](https://junglewise.ai/threats/cve-2026-63020-f5-big-ip-configuration-utility-error-message-spoofing)
- [F5 BIG-IP denial of service in HTTP/2 profile memory management](https://junglewise.ai/threats/cve-2026-59762-f5-big-ip-denial-of-service-in-http-2-profile-memory-management)
- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)
- [F5 BIG-IP privilege escalation in iControl SOAP via SNMP configuration](https://junglewise.ai/threats/cve-2026-42924-f5-big-ip-privilege-escalation-in-icontrol-soap-via-snmp)