CVE-2026-66842: BIG-IP Privilege Escalation Vulnerability

CVE-2026-66842 Overview

CVE-2026-66842 affects F5 BIG-IP and allows an authenticated user of any role to create administrative accounts. The flaw resides in the Traffic Management User Interface (TMUI) and is triggered through an undisclosed request. An attacker with network access to the BIG-IP management interface can escalate privileges by provisioning new administrator users. F5 confirms the issue is limited to the control plane and does not expose the data plane. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5.

Critical Impact
Any authenticated BIG-IP user, regardless of role, can create administrative accounts and gain full control of the appliance management plane.

Affected Products

F5 BIG-IP (Traffic Management User Interface)
Supported BIG-IP versions with TMUI enabled on the management interface
End of Technical Support (EoTS) versions were not evaluated

Discovery Timeline

2026-09-02 - CVE-2026-66842 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-66842

Vulnerability Analysis

CVE-2026-66842 is a privilege escalation vulnerability in the BIG-IP Traffic Management User Interface. F5 categorizes the weakness under [CWE-918] Server-Side Request Forgery, indicating the escalation path involves TMUI issuing a request that bypasses role enforcement. An authenticated low-privilege user issues an undisclosed request to TMUI and receives the ability to create new administrator accounts. The exploitation path crosses trust boundaries within TMUI itself rather than through the data plane. Successful exploitation grants full administrative control of the BIG-IP system, including configuration changes, credential access, and traffic policy modification.

Root Cause

The vulnerability stems from missing or insufficient authorization checks on a TMUI request handler that provisions user accounts. TMUI accepts the request from any authenticated session and processes account creation without validating that the calling role holds administrative rights. F5 has not disclosed the specific endpoint or parameters involved.

Attack Vector

Exploitation requires network reachability to the BIG-IP management interface and valid credentials for any BIG-IP role. The attacker authenticates to TMUI, issues the crafted request, and creates an administrative account. From that account, the attacker holds full control of the appliance. The vulnerability is not exploitable from the data plane and does not affect traffic that BIG-IP processes for backend applications.

No verified proof-of-concept code has been published. Refer to the F5 Support Article K000162521 for vendor-supplied technical detail.

Detection Methods for CVE-2026-66842

Indicators of Compromise

Creation of new BIG-IP user accounts with the administrator role outside of change-approved windows
TMUI audit log entries showing account provisioning actions initiated by non-administrator sessions
Unexpected authentication events from newly created accounts on the management interface
Configuration changes or credential exports performed shortly after suspicious account creation

Detection Strategies

Review /var/log/audit and TMUI audit trails for create user or role assignment events correlated with low-privilege session IDs
Alert on any privilege change where the initiating principal does not already hold administrator rights
Baseline the population of administrative accounts and flag deviations against configuration management records

Monitoring Recommendations

Forward BIG-IP audit and secure logs to a centralized log platform for correlation and retention
Monitor management interface access for authenticated sessions from unexpected source networks
Track TMUI HTTP request patterns for anomalous POST activity to user administration endpoints

How to Mitigate CVE-2026-66842

Immediate Actions Required

Apply the fixed BIG-IP versions listed in F5 Support Article K000162521 as soon as a maintenance window allows
Restrict management interface access to a dedicated administrative network and trusted jump hosts
Audit all BIG-IP user accounts and remove any administrator accounts that cannot be attributed to an approved change
Rotate credentials for any account that could have accessed TMUI while the appliance was unpatched

Patch Information

F5 has published fixed software versions and workaround guidance in F5 Support Article K000162521. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch. Confirm the running version with tmsh show sys version before and after applying updates.

Workarounds

Block network access to TMUI from all networks except a hardened management VLAN
Enforce multi-factor authentication for BIG-IP management logins to raise the cost of credential abuse
Reduce the number of accounts with any TMUI access to the minimum required for operations
Enable and centrally forward BIG-IP audit logging to detect abuse while patching is scheduled

bash

# Example: restrict TMUI to a management network using tmsh
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config

# Verify current version and applied restrictions
tmsh show sys version
tmsh list sys httpd allow