CVE-2026-42406: BIG-IP and BIG-IQ RCE Vulnerability

CVE-2026-42406 Overview

CVE-2026-42406 affects F5 BIG-IP and BIG-IQ systems. An authenticated attacker with the Certificate Manager role or higher can modify configuration objects to execute arbitrary commands. The flaw is categorized under [CWE-267] Privilege Defined With Unsafe Actions, meaning a role intended for certificate management permits actions beyond its expected scope. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated for this issue.

Critical Impact

An authenticated user holding the Certificate Manager role can escalate privileges and run arbitrary commands on BIG-IP and BIG-IQ systems, undermining configuration integrity and host confidentiality.

Affected Products

• F5 BIG-IP (supported versions per F5 advisory)
• F5 BIG-IQ Centralized Management (supported versions per F5 advisory)
• Software versions past End of Technical Support are not evaluated

Discovery Timeline

• 2026-05-13 - CVE-2026-42406 published to the National Vulnerability Database (NVD)
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42406

Vulnerability Analysis

The vulnerability resides in the role-based access control (RBAC) model used by BIG-IP and BIG-IQ. The Certificate Manager role is designed to manage TLS certificates, keys, and related cryptographic material. However, certain configuration objects accessible to this role can be modified in ways that result in arbitrary command execution on the underlying system.

Because the attacker must already hold high privileges, the issue represents a privilege boundary violation rather than an unauthenticated remote compromise. An adversary who has obtained Certificate Manager credentials, through credential theft, insider access, or compromise of an administrator workstation, can pivot from certificate operations to full command execution. The result is a breach of the confidentiality and integrity of the appliance configuration.

Root Cause

The root cause is improper enforcement of the principle of least privilege within configuration object handlers. Configuration objects reachable by the Certificate Manager role accept input that is later interpreted as commands or used in command construction on the management plane. The role's permissions were not constrained tightly enough to prevent this transition from data modification to code execution.

Attack Vector

The attack vector is network-based and requires authentication. An attacker reaches the BIG-IP or BIG-IQ management interface, authenticates with at least Certificate Manager privileges, and submits crafted modifications to vulnerable configuration objects. The malicious payload is processed server-side and executed in the context of the management process, producing arbitrary command execution on the appliance.

No verified public proof-of-concept code is available at the time of writing. Refer to the F5 Support Article K000160971 for vendor-specific technical detail.

Detection Methods for CVE-2026-42406

Indicators of Compromise

• Unexpected configuration changes made by accounts holding the Certificate Manager role, particularly to objects unrelated to certificates or keys
• Shell processes, scripting interpreters, or outbound network connections spawned by BIG-IP or BIG-IQ management daemons
• Audit log entries showing configuration object modifications followed by command execution events on the management plane

Detection Strategies

• Review F5 audit logs (/var/log/audit, restjavad, tmsh history) for configuration changes correlated with command execution
• Baseline normal Certificate Manager activity and alert on deviations such as edits to non-certificate configuration objects
• Forward BIG-IP and BIG-IQ audit and system logs to a centralized SIEM for correlation across appliances

Monitoring Recommendations

• Enable verbose audit logging for all administrative role activity on BIG-IP and BIG-IQ
• Monitor authentication events for Certificate Manager accounts, including source IP, time of day, and geolocation anomalies
• Track process lineage on F5 appliances where supported, alerting on management services launching unexpected child processes

How to Mitigate CVE-2026-42406

Immediate Actions Required

• Apply the fixed software versions listed in F5 Support Article K000160971 as soon as the vendor patch is available
• Restrict access to the BIG-IP and BIG-IQ management interfaces to dedicated administrative networks only
• Audit accounts assigned the Certificate Manager role and remove any unnecessary assignments
• Rotate credentials for all administrative roles, including Certificate Manager accounts

Patch Information

Consult F5 Support Article K000160971 for the authoritative list of fixed releases. F5 does not evaluate End of Technical Support versions, so customers on EoTS releases must upgrade to a supported branch to receive a fix.

Workarounds

• Limit assignment of the Certificate Manager role to a minimal set of trusted administrators
• Enforce multi-factor authentication on all BIG-IP and BIG-IQ administrative accounts
• Place the management plane behind a jump host with strict access controls and session recording
• Segment the management network from production traffic and block direct internet exposure of the management interface