CVE-2026-20916: BIG-IQ Path Traversal Vulnerability

CVE-2026-20916 Overview

CVE-2026-20916 is a path traversal vulnerability [CWE-22] affecting the F5 BIG-IQ centralized management platform. An authenticated iControl REST user with low privileges can create or modify arbitrary files on the BIG-IQ system through an undisclosed iControl REST endpoint. F5 has not evaluated software versions that have reached End of Technical Support (EoTS). The flaw breaks integrity and availability boundaries on the management appliance, enabling tampering with configuration files, scripts, or binaries used by the platform.

Critical Impact
A low-privileged authenticated attacker can write arbitrary files to the BIG-IQ filesystem, leading to configuration tampering, persistence, and potential privilege escalation on the management plane.

Affected Products

F5 BIG-IQ Centralized Management (supported versions, per F5 advisory)
iControl REST API interface on BIG-IQ
EoTS versions of BIG-IQ are not evaluated by F5

Discovery Timeline

2026-05-13 - CVE-2026-20916 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-20916

Vulnerability Analysis

The vulnerability resides in an undisclosed iControl REST endpoint on F5 BIG-IQ. iControl REST is the management API used to configure and orchestrate BIG-IP devices from BIG-IQ. The affected endpoint accepts file path or file content parameters from authenticated callers and writes data to the underlying filesystem without sufficient validation.

Because the endpoint enforces only low-privilege authentication, any account with iControl REST access can invoke the write operation. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). The attack vector is network-based, requires low complexity, and impacts integrity and availability without affecting confidentiality.

According to the EPSS model, CVE-2026-20916 has an exploitation probability of 0.073% with a percentile of 22.05, and no public exploit code is currently available.

Root Cause

The root cause is insufficient authorization and path validation on an iControl REST handler. The endpoint trusts authenticated input to determine the target file path or content, allowing traversal outside intended directories. Authorization checks fail to restrict file-write operations to administrative roles, so low-privilege accounts inherit administrative file-system reach.

Attack Vector

An attacker authenticates to the BIG-IQ iControl REST API with any valid low-privilege account. The attacker then issues a crafted request to the vulnerable endpoint, supplying a target path and content payload. The BIG-IQ system writes the attacker-controlled data to disk, overwriting existing files or creating new ones. Attackers can use this primitive to drop scheduled jobs, replace scripts executed by privileged services, or poison configuration files to achieve code execution as a higher-privileged user.

No verified exploit code is publicly available. Refer to the F5 Knowledge Article K000158029 for vendor-supplied technical details.

Detection Methods for CVE-2026-20916

Indicators of Compromise

Unexpected iControl REST API calls from low-privilege user accounts targeting file-handling endpoints
New or modified files in system directories on BIG-IQ that do not correspond to scheduled updates or administrator activity
Anomalous HTTP requests to undocumented /mgmt/tm/ or /mgmt/shared/ iControl REST paths containing path-traversal sequences such as ../

Detection Strategies

Audit BIG-IQ restjavad-audit and restnoded logs for write operations initiated by non-administrative accounts
Correlate iControl REST authentication events with subsequent file modification timestamps on the appliance filesystem
Alert on iControl REST requests containing encoded traversal patterns or absolute paths in body parameters

Monitoring Recommendations

Forward BIG-IQ audit and REST API logs to a centralized SIEM for retention and behavioral analysis
Baseline normal iControl REST usage per account role and alert on deviations such as file-write verbs from read-only roles
Monitor file integrity on critical BIG-IQ directories including /etc, /var/config, and script execution paths

How to Mitigate CVE-2026-20916

Immediate Actions Required

Apply the fixed BIG-IQ versions listed in F5 Knowledge Article K000158029 as soon as maintenance windows allow
Restrict iControl REST API access to trusted management networks using network ACLs or a dedicated management VLAN
Audit all iControl REST user accounts and remove or rotate credentials for accounts that no longer require API access

Patch Information

F5 has published remediation guidance in F5 Knowledge Article K000158029. Administrators should consult the advisory for the list of fixed BIG-IQ versions and upgrade paths. Software versions at End of Technical Support are not evaluated and should be upgraded to a supported release.

Workarounds

Block external access to the BIG-IQ management interface and iControl REST endpoints at the perimeter firewall
Enforce least privilege on iControl REST accounts and revoke API tokens for users who do not require write operations
Enable and monitor file integrity checks on the BIG-IQ appliance to detect unauthorized file modifications

bash

# Configuration example: restrict iControl REST to a management subnet
# (Apply via BIG-IQ TMOS shell — adjust subnet to your environment)
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 127.0.0.0/8 }
tmsh save sys config