CVE-2026-41959: BIG-IP Information Disclosure Vulnerability

CVE-2026-41959 Overview

CVE-2026-41959 is an incorrect permission assignment vulnerability [CWE-732] affecting F5 BIG-IP and BIG-IQ products. The flaw exists in the TMOS Shell (tmsh) network diagnostics commands and in the BIG-IP iControl REST interface. An authenticated attacker can leverage misassigned permissions to view the network status of destination systems reachable from the affected device. F5 notes that software versions which have reached End of Technical Support (EoTS) were not evaluated for this issue.

Critical Impact
Authenticated users with low privileges can disclose network reachability information about destination systems, exposing internal topology and aiding reconnaissance for follow-on attacks.

Affected Products

F5 BIG-IP (TMOS Shell tmsh network diagnostics commands)
F5 BIG-IP (iControl REST interface)
F5 BIG-IQ (TMOS Shell tmsh network diagnostics commands)

Discovery Timeline

2026-05-13 - CVE-2026-41959 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41959

Vulnerability Analysis

The vulnerability resides in how BIG-IP and BIG-IQ assign permissions to network diagnostic functionality. Both the tmsh shell network diagnostics commands and the iControl REST interface expose diagnostic operations to authenticated roles that should not have access to them. When invoked, these operations return information about the network status of destination systems behind the appliance.

The underlying weakness maps to [CWE-732] (Incorrect Permission Assignment for Critical Resource). Network diagnostic commands on a load balancer or application delivery controller can reveal whether internal services are up, what addresses respond, and how the appliance routes traffic. This information supports lateral reconnaissance against the protected environment.

Exploitation requires valid credentials but no user interaction. Attackers with low-privileged accounts, including compromised operator or auditor accounts, can issue diagnostic queries that should be restricted to administrators.

Root Cause

The root cause is improper role-based access control on diagnostic primitives. The tmsh parser and the iControl REST endpoints did not enforce the privilege checks needed to gate network status queries. As a result, lower-privileged authenticated principals could call diagnostics that disclose information about systems beyond their authorization scope.

Attack Vector

The attack vector is network-based. An attacker with valid BIG-IP or BIG-IQ credentials connects to the management interface over SSH to reach tmsh, or sends HTTPS requests to the iControl REST API. The attacker then issues diagnostic commands targeting internal addresses and observes the responses to map reachability of backend services. No code execution is required to extract this information.

No verified public proof-of-concept code is available. Refer to the F5 Security Advisory K000161022 for vendor-supplied technical details.

Detection Methods for CVE-2026-41959

Indicators of Compromise

Unexpected tmsh sessions from non-administrative accounts invoking network diagnostic subcommands such as ping, traceroute, or interface status queries.
iControl REST API requests to diagnostic endpoints originating from user accounts that have no operational reason to query destination network status.
Bursts of diagnostic queries against internal IP ranges from a single authenticated session.

Detection Strategies

Enable and centralize BIG-IP audit logging for tmsh command execution and correlate command usage against role assignments.
Forward iControl REST access logs to a SIEM and alert when low-privileged accounts call diagnostic URIs.
Baseline normal diagnostic usage per account and flag deviations, especially diagnostics targeting addresses outside the account's typical scope.

Monitoring Recommendations

Monitor management plane authentication for credential reuse, brute force, or logins from unexpected source addresses.
Track iControl REST request volumes per user and alert on sustained diagnostic activity from non-admin roles.
Review user role assignments quarterly and remove unused operator, auditor, or guest accounts that could be abused for reconnaissance.

How to Mitigate CVE-2026-41959

Immediate Actions Required

Apply the fixed BIG-IP and BIG-IQ versions listed in F5 Security Advisory K000161022 as soon as maintenance windows allow.
Inventory all local and remote accounts on BIG-IP and BIG-IQ devices and remove or disable any account that does not require management access.
Restrict the management interface and iControl REST endpoint to a dedicated administrative network segment.

Patch Information

F5 has published remediation guidance in F5 Security Advisory K000161022. Administrators should consult the advisory for the specific fixed versions that correspond to their installed BIG-IP or BIG-IQ branch. Versions that have reached End of Technical Support were not evaluated and should be upgraded to a supported branch.

Workarounds

Limit tmsh and iControl REST access to administrator-level roles only and audit existing role assignments for least privilege.
Place the management plane behind a jump host or VPN and block direct access from user networks.
Enforce strong authentication on BIG-IP and BIG-IQ management accounts, including multi-factor authentication where supported.

bash

# Configuration example: restrict iControl REST and tmsh access
# Review user roles and downgrade non-admin accounts
tmsh list auth user
tmsh modify auth user <username> partition-access replace-all-with { all-partitions { role operator } }

# Restrict management access to a trusted network
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config