CVE-2026-42919: BIG-IP Privilege Escalation Vulnerability

CVE-2026-42919 Overview

CVE-2026-42919 is a privilege escalation vulnerability in F5 BIG-IP systems. An authenticated attacker with administrative access can exploit this flaw to cross a security boundary and elevate privileges beyond the administrative scope. The weakness is classified as a stack-based buffer overflow [CWE-121]. F5 published security article K000158971 to address the issue. Software versions that reached End of Technical Support (EoTS) were not evaluated and may remain exposed.

Critical Impact

Successful exploitation lets an authenticated administrator escape the BIG-IP administrative boundary, gain higher-privileged execution context, and compromise the integrity and availability of the appliance.

Affected Products

• F5 BIG-IP (versions referenced in F5 advisory K000158971)
• BIG-IP software releases still within Technical Support
• BIG-IP deployments exposing administrative interfaces to authenticated users

Discovery Timeline

• 2026-05-13 - CVE-2026-42919 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42919

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in BIG-IP. An authenticated user with administrative credentials can supply input that exceeds the bounds of a fixed-size stack buffer. The overflow corrupts adjacent stack memory, including saved return addresses and control data. An attacker who controls the overflow can redirect execution and obtain a privilege level higher than the administrative role.

The attack vector is network-reachable, requires high privileges, and does not require user interaction. While the confidentiality impact is limited, the integrity and availability impacts on the vulnerable component are high. The flaw crosses a security boundary, which is significant on appliances where administrators are not expected to obtain root-equivalent control.

Root Cause

The root cause is missing or insufficient bounds checking on input written to a stack buffer in a privileged BIG-IP code path. When the input length exceeds the allocated buffer size, the process writes past the buffer and overwrites stack frames. This enables corruption of program state and control flow.

Attack Vector

Exploitation requires valid administrative credentials and network access to the BIG-IP management plane. The attacker submits a crafted request containing an oversized payload to the vulnerable interface. The overflow triggers within a higher-privileged process, allowing the attacker to escape role limitations on the appliance. Refer to the F5 Security Article K000158971 for vendor-confirmed exploitation conditions and fixed versions.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low probability of near-term exploitation activity.

Detection Methods for CVE-2026-42919

Indicators of Compromise

• Unexpected process crashes, segmentation faults, or core dumps generated by BIG-IP management or control-plane services.
• Administrative sessions issuing unusually long parameters or binary payloads to configuration endpoints.
• New root-owned files, cron entries, or shell histories created shortly after administrative API activity.

Detection Strategies

• Audit BIG-IP /var/log/audit and /var/log/restjavad entries for oversized inputs, malformed parameters, or repeated 500-class errors from administrative endpoints.
• Correlate administrative logins with subsequent privilege transitions and process executions outside the expected admin scope.
• Alert on configuration changes performed immediately after authentication from previously unseen source IPs.

Monitoring Recommendations

• Forward BIG-IP audit, secure, and REST framework logs to a centralized analytics platform for retention and correlation.
• Track administrative API usage baselines per account and flag deviations in payload size or endpoint frequency.
• Monitor outbound connections originating from BIG-IP appliances, which should be minimal in steady state.

How to Mitigate CVE-2026-42919

Immediate Actions Required

• Apply the fixed BIG-IP versions identified in F5 Security Article K000158971 as soon as maintenance windows allow.
• Restrict access to the BIG-IP management interface to dedicated management networks and jump hosts.
• Review administrative account inventory and remove unused or shared administrative credentials.
• Rotate credentials and API tokens for any administrative account that may have been exposed.

Patch Information

F5 has published guidance and fixed versions in security advisory K000158971. Administrators should consult the F5 Security Article K000158971 for the authoritative list of affected and fixed software branches. Appliances on End of Technical Support releases are not evaluated and should be upgraded to a supported branch.

Workarounds

• Limit administrative access to trusted source IP ranges using management-plane access controls.
• Enforce multi-factor authentication for all administrative accounts on BIG-IP.
• Apply least-privilege role assignments and avoid granting broad administrative roles to operational accounts.
• Disable or quarantine appliances running unsupported software until they can be upgraded.

# Configuration example: restrict BIG-IP management access by source
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.10.0/24 }
tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 192.168.10.0/24 }
tmsh save sys config