CVE-2026-41217: BIG-IP TMOS Privilege Escalation Flaw

CVE-2026-41217 Overview

CVE-2026-41217 is an authenticated privilege escalation vulnerability in the F5 BIG-IP TMOS Shell (tmsh). An undisclosed tmsh command allows an authenticated attacker holding the resource administrator or administrator role to execute arbitrary system commands at a higher privilege level. In Appliance mode deployments, successful exploitation enables the attacker to cross a documented security boundary that normally restricts administrative access to the underlying operating system. The flaw is tracked under CWE-732: Incorrect Permission Assignment for Critical Resource and affects supported BIG-IP releases. Software versions that reached End of Technical Support (EoTS) were not evaluated by F5.

Critical Impact

Authenticated administrators can break Appliance mode isolation and execute arbitrary OS commands with elevated privileges on BIG-IP systems.

Affected Products

• F5 BIG-IP (TMOS) supported branches running the affected tmsh command set
• BIG-IP deployments configured in Appliance mode
• Software versions past End of Technical Support were not evaluated and may also be impacted

Discovery Timeline

• 2026-05-13 - CVE-2026-41217 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41217

Vulnerability Analysis

The vulnerability resides in an undisclosed command exposed by the BIG-IP TMOS Shell, the primary administrative interface for managing F5 BIG-IP devices. The tmsh environment is designed to constrain administrators to a defined set of management operations, particularly under Appliance mode where direct shell access to the underlying Linux host is forbidden. The affected command improperly delegates execution privileges, permitting an authenticated user with the resource administrator or administrator role to invoke arbitrary system commands at a higher privilege context than their assigned role permits.

Because exploitation requires valid administrative credentials and local access to the management plane, the attack surface is constrained. However, the impact is significant on hardened Appliance mode deployments where the security model explicitly assumes administrators cannot reach the underlying operating system.

Root Cause

The root cause is an incorrect permission assignment ([CWE-732]) on a privileged tmsh command. The command does not properly enforce the role-based execution restrictions expected under Appliance mode, allowing privileged operations to be invoked outside their intended security boundary.

Attack Vector

An attacker must first authenticate to the BIG-IP management interface with resource administrator or administrator credentials. Once authenticated, the attacker invokes the affected tmsh command with crafted arguments to trigger execution of arbitrary OS commands in a higher-privileged context. In Appliance mode, this breaks the isolation that normally prevents shell-level access, allowing the attacker to read, modify, or replace system files and compromise the integrity of the device.

No public proof-of-concept code or exploitation details have been released by F5. See the F5 Security Article K000161107 for vendor guidance.

Detection Methods for CVE-2026-41217

Indicators of Compromise

• Unexpected tmsh command invocations originating from administrator or resource administrator accounts outside of normal change windows
• Audit log entries showing privileged shell processes (for example bash, sh, or python) spawned as a child of tmsh
• Modification of system files or configuration outside the standard tmsh configuration sync workflow

Detection Strategies

• Enable and forward BIG-IP audit logs (/var/log/audit) and secure logs to a centralized log aggregator for inspection
• Baseline normal tmsh command usage per administrator account and alert on rare or undocumented subcommands
• Correlate authentication events with subsequent privileged command execution to identify session abuse

Monitoring Recommendations

• Monitor for new local user creation, SSH key additions, or sudoers modifications following administrator login
• Track changes to Appliance mode enforcement settings and alert on attempts to disable mode restrictions
• Review administrator role assignments regularly and remove unused or excessive privileges

How to Mitigate CVE-2026-41217

Immediate Actions Required

• Apply the fixed BIG-IP software version listed in F5 Security Article K000161107 as soon as it is validated in your environment
• Restrict assignment of administrator and resource administrator roles to a minimum set of trusted operators
• Rotate credentials and review audit logs for any anomalous tmsh activity prior to patching

Patch Information

F5 has published remediation guidance in F5 Security Article K000161107. Administrators should consult the article for the list of fixed releases per BIG-IP branch and upgrade to a supported, patched version. Versions that have reached End of Technical Support were not evaluated and should be migrated to a supported release.

Workarounds

• Limit management plane access to a dedicated out-of-band network reachable only by trusted administrators
• Enforce multi-factor authentication on all administrative accounts that can authenticate to tmsh
• Review and reduce the number of accounts assigned the administrator or resource administrator role until patching is complete

# Configuration example: list and audit users with elevated BIG-IP roles
tmsh list auth user one-line | grep -E 'admin|resource-admin'

# Restrict management access to a trusted subnet
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config