CVE-2026-42063: iControl SOAP Information Disclosure Flaw

CVE-2026-42063 Overview

CVE-2026-42063 is a sensitive file exposure vulnerability in F5 iControl SOAP. An authenticated attacker holding the Resource Administrator or Administrator role can download sensitive files from the affected system. The flaw is categorized under CWE-552, Files or Directories Accessible to External Parties.

The vulnerability requires high privileges and network access but no user interaction. Software versions which have reached End of Technical Support (EoTS) are not evaluated by the vendor. F5 published advisory K000160973 with remediation guidance.

Critical Impact
An authenticated administrator can exfiltrate sensitive configuration or credential material from iControl SOAP, enabling deeper compromise of network infrastructure.

Affected Products

F5 iControl SOAP interface (refer to F5 advisory K000160973 for specific affected versions)
F5 BIG-IP products exposing iControl SOAP
End-of-Technical-Support (EoTS) versions are not evaluated and may also be affected

Discovery Timeline

2026-05-13 - CVE-2026-42063 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42063

Vulnerability Analysis

The vulnerability resides in the iControl SOAP management interface exposed by F5 products. iControl SOAP is the legacy XML-based API used to programmatically configure and manage BIG-IP devices. The interface fails to properly restrict which files an authenticated administrative user can retrieve.

An attacker authenticated as Resource Administrator or Administrator can leverage the SOAP interface to download files outside the scope of normal management operations. This information exposure aligns with [CWE-552], where files or directories are accessible to parties that should not have access through a particular channel.

While administrative roles are inherently trusted, this flaw allows lateral movement within the trust boundary. Credentials, private keys, configuration backups, and other sensitive artifacts stored on the device become reachable through SOAP requests. The exposure is meaningful in environments where role separation is used to limit administrator visibility into specific files.

Root Cause

The root cause is insufficient access control on file retrieval operations exposed through iControl SOAP. The interface does not adequately validate whether the requesting role should be permitted to download a given file path, allowing privileged users to bypass intended file-level restrictions.

Attack Vector

Exploitation requires network access to the iControl SOAP endpoint and valid credentials with Resource Administrator or Administrator privileges. The attacker issues a crafted SOAP request invoking a file download method and specifies a target file path. The server returns the file contents to the authenticated session. No user interaction is required.

The vulnerability is described in vendor documentation rather than public proof-of-concept code. See the F5 Support Article K000160973 for technical specifics.

Detection Methods for CVE-2026-42063

Indicators of Compromise

Unexpected SOAP requests to iControl endpoints invoking file download or transfer methods
Administrator or Resource Administrator sessions originating from unusual source IP addresses or geolocations
Outbound transfers of large or sensitive files following authenticated SOAP activity
Access patterns targeting paths containing configuration, credential, or key material

Detection Strategies

Enable and review iControl SOAP audit logging for file retrieval method invocations
Correlate administrative authentication events with subsequent SOAP API calls to identify anomalous access patterns
Alert on SOAP requests referencing sensitive file paths or file extensions such as .key, .conf, or backup archives
Baseline normal administrator activity and flag deviations in request volume or method usage

Monitoring Recommendations

Forward BIG-IP audit and management plane logs to a centralized SIEM for retention and correlation
Monitor privileged role assignments and changes to Administrator or Resource Administrator membership
Track network flows from the management interface to detect unexpected data egress

How to Mitigate CVE-2026-42063

Immediate Actions Required

Apply the fixed software version listed in F5 advisory K000160973
Audit accounts holding Resource Administrator and Administrator roles and remove unnecessary assignments
Rotate credentials, certificates, and private keys that may have been exposed on the affected device
Restrict network access to the iControl SOAP interface to a dedicated management network

Patch Information

F5 has published remediation guidance in support article K000160973. Administrators should consult the advisory for the list of fixed versions and upgrade paths. Versions that have reached End of Technical Support are not evaluated and require migration to a supported branch.

Workarounds

Disable the iControl SOAP interface where it is not required for operations
Enforce strict network access control lists (ACLs) limiting management interface reachability to trusted jump hosts
Apply the principle of least privilege by replacing broad Administrator roles with scoped roles where feasible
Require multi-factor authentication for all privileged management accounts

bash

# Example: restrict iControl SOAP access to a management subnet using tmsh
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 127.0.0.0/8 }
tmsh save sys config