Arbitrary Command Execution Vulnerability in F5 iControl REST and TMOS Shell
CVE-2026-39459

8.6HIGH

Key Information:

Vendor

F5
Status
Big-ip
Vendor
CVE Published:
13 May 2026

What is CVE-2026-39459?

A significant security flaw exists in F5's iControl REST and the TMOS Shell, whereby an authenticated user with Manager role privileges can create configuration objects that enable the execution of arbitrary commands on the system. This vulnerability could potentially lead to unauthorized access and manipulation of sensitive data, highlighting the importance of monitoring user roles and implementing strict access controls.

Affected Version(s)

BIG-IP 21.0.0 < 21.0.0.2

BIG-IP 17.5.0 < 17.5.1.6

BIG-IP 17.1.0 < 17.1.3.2

References

https://my.f5.com/manage/s/article/K000160863
vendor-advisorypatch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Adam Logue for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.