CVE-2026-24464: Path Traversal Vulnerability in iControl

CVE-2026-24464 Overview

CVE-2026-24464 is a directory traversal vulnerability [CWE-35] affecting F5 BIG-IP systems running in Appliance mode. The flaw resides in an undisclosed iControl REST endpoint and allows an authenticated attacker with administrator role privileges to cross a security boundary and delete files on the system.

Appliance mode is a hardened operating mode that restricts administrator access to limit privileged operations on the underlying system. This vulnerability undermines that restriction. F5 published advisory K000160911 describing the issue. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Authenticated administrators on BIG-IP Appliance mode systems can delete arbitrary files through an iControl REST endpoint, breaking the Appliance mode security boundary and potentially affecting system integrity.

Affected Products

F5 BIG-IP (running in Appliance mode)
iControl REST interface on supported BIG-IP versions
See F5 advisory K000160911 for the full version matrix

Discovery Timeline

2026-05-13 - CVE-2026-24464 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-24464

Vulnerability Analysis

The vulnerability is a directory traversal flaw [CWE-35] in an undisclosed iControl REST endpoint on F5 BIG-IP. iControl REST is the management API used to configure and operate BIG-IP devices. When the system runs in Appliance mode, administrative actions are intentionally constrained to a defined set of operations to prevent users from interacting directly with the underlying OS.

The affected endpoint accepts a file path parameter without sufficient normalization or canonicalization. An attacker can supply traversal sequences to reference paths outside the intended directory. The endpoint then performs a delete operation against the resolved path, crossing the Appliance mode security boundary.

Exploitation requires high privileges, since the attacker must already hold the administrator role and authenticate to iControl REST. The impact is limited to integrity through file deletion. There is no confirmed impact to confidentiality or availability beyond the consequences of removing files the attacker should not be able to touch.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory in an iControl REST handler. The endpoint trusts caller-supplied path input and does not enforce the Appliance mode constraints that should prevent file operations outside the API's authorized scope.

Attack Vector

The attack vector is network-based against the iControl REST management interface. An attacker authenticates as an administrator, then issues a crafted REST request containing traversal sequences in a path parameter to trigger deletion of a file outside the intended directory. No user interaction is required. Refer to the F5 Security Article K000160911 for endpoint-specific technical details.

Detection Methods for CVE-2026-24464

Indicators of Compromise

iControl REST requests from administrator accounts containing path traversal sequences such as ../ or encoded variants (%2e%2e%2f) in URI parameters or JSON bodies
Unexpected file deletions on BIG-IP system paths outside normal configuration directories
REST API DELETE or file-management calls originating from management interfaces at unusual times or from atypical source addresses

Detection Strategies

Inspect restjavad and audit logs (/var/log/audit, /var/log/restjavad.0.log) for iControl REST calls containing traversal patterns in path parameters
Correlate administrator login events with subsequent file deletion or filesystem-modifying REST operations
Baseline normal iControl REST usage per administrator and flag deviations involving file path arguments

Monitoring Recommendations

Forward BIG-IP audit and restjavad logs to a centralized SIEM and alert on path traversal signatures targeting iControl REST endpoints
Monitor administrator role assignments and authentication events for the management plane
Track integrity of critical system and configuration files on BIG-IP appliances and alert on unauthorized deletions

How to Mitigate CVE-2026-24464

Immediate Actions Required

Apply the fixed software versions listed in F5 Security Article K000160911 as soon as your change window allows
Restrict iControl REST access to a dedicated management network and trusted administrative hosts only
Audit administrator accounts on BIG-IP and remove unused or excessive privileges

Patch Information

F5 provides remediation guidance and fixed version information in advisory K000160911. Systems running versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded to a supported release.

Workarounds

Limit network access to the BIG-IP management interface and iControl REST port using firewall rules and a management VLAN
Enforce strong authentication and rotate administrator credentials, ensuring only required personnel hold the administrator role
Increase logging verbosity on iControl REST and forward logs off-box to detect exploitation attempts

bash

# Example: restrict management access using BIG-IP tmsh
# Allow only specific admin subnets to reach the management interface
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.50.0/24 }
tmsh save sys config