CVE-2026-41225: iControl REST RCE Vulnerability

CVE-2026-41225 Overview

CVE-2026-41225 is an authenticated command execution vulnerability in F5's iControl REST interface. An attacker holding at least the Manager role can create configuration objects that execute arbitrary commands on the underlying system. The flaw is categorized under CWE-648: Incorrect Use of Privileged APIs.

The vulnerability requires high privileges but exposes the management plane to full compromise of confidentiality, integrity, and availability. F5 documented the issue in F5 Security Article K000160916. Software versions that have reached End of Technical Support (EoTS) were not evaluated.

Critical Impact
Authenticated Manager-role users can pivot management API access into arbitrary command execution on the F5 device, leading to full host compromise.

Affected Products

F5 products exposing the iControl REST management API (see vendor advisory for specific branches and versions)
Configurations where the Manager role or higher is granted to operational accounts
Deployments running supported BIG-IP releases referenced in F5 K000160916

Discovery Timeline

2026-05-13 - CVE-2026-41225 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41225

Vulnerability Analysis

The vulnerability resides in iControl REST, the management API used to configure F5 devices. Specific configuration objects accept attributes that the system later interprets as commands during processing. A Manager-role user can submit crafted object definitions through the REST interface and trigger command execution within the management context.

The issue maps to CWE-648: Incorrect Use of Privileged APIs. The iControl REST endpoint exposes administrative primitives that should be restricted to lower-risk operations for non-root administrative roles. Because the Manager role is intended as a delegated administration tier rather than full root, the ability to reach shell-level execution constitutes a privilege boundary violation.

Root Cause

The root cause is over-trust of attributes within specific configuration object types. The iControl REST layer does not constrain field values that flow into command interpreters during object creation or activation. Manager-role authorization is enforced for the API call itself, but the downstream execution path runs with broader system privileges than the calling role should command.

Attack Vector

The attack vector is network-based against the management interface. An attacker first authenticates with credentials carrying the Manager role or higher. The attacker then issues an HTTP request to the iControl REST endpoint to create or modify a configuration object whose fields embed an operating system command. When the device processes the object, the embedded command executes.

No verified public proof-of-concept is available at this time. Refer to F5 Security Article K000160916 for vendor-supplied technical details and impacted components.

Detection Methods for CVE-2026-41225

Indicators of Compromise

Unexpected configuration object creation or modification events in iControl REST audit logs, especially from accounts that do not normally perform configuration changes.
New or modified scripts, iRules, or system objects whose content includes shell metacharacters, base64 blobs, or references to /bin/sh, bash, or curl.
Outbound network connections originating from the BIG-IP management plane to unfamiliar IP addresses or domains.

Detection Strategies

Alert on POST and PATCH requests to /mgmt/tm/ iControl REST paths that create or alter object types historically unused in the environment.
Correlate Manager-role authentication events with subsequent configuration changes and process executions on the device.
Monitor for child processes spawned by management daemons (restjavad, restnoded) that are not part of expected BIG-IP operations.

Monitoring Recommendations

Forward iControl REST audit logs, secure logs, and audit logs to a centralized SIEM for retention and correlation.
Track all accounts assigned the Manager role or higher and review role assignments at a regular cadence.
Baseline normal iControl REST traffic patterns to surface anomalous bursts of configuration changes or unusual user agents.

How to Mitigate CVE-2026-41225

Immediate Actions Required

Apply the fixed versions documented in F5 Security Article K000160916 as soon as upgrade windows allow.
Restrict the iControl REST management interface to trusted administrative networks using packet filters or a dedicated management VLAN.
Audit all accounts granted the Manager role or higher and remove unnecessary privilege assignments.

Patch Information

F5 has published vendor guidance and fixed software in F5 Security Article K000160916. Software versions that have reached End of Technical Support are not evaluated, so administrators running EoTS releases must upgrade to a supported branch before patching can mitigate the issue.

Workarounds

Limit iControl REST exposure with httpd allow-lists or upstream firewall rules so that only known administrative hosts can reach the API.
Enforce strong authentication on all administrative accounts and rotate credentials for accounts that previously held the Manager role.
Use the principle of least privilege when assigning F5 roles, granting Manager only when the operational requirement is documented.

bash

# Restrict iControl REST access to a management subnet (example)
tmsh modify sys httpd allow replace-all-with { 10.10.0.0/24 127.0.0.0/8 }
tmsh save sys config