Arbitrary Command Execution Vulnerability in BIG-IP DNS by F5

CVE-2026-40061

What is CVE-2026-40061?

A significant vulnerability in BIG-IP DNS can allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary commands with elevated privileges. This vulnerability arises from undisclosed commands within the iControl REST and BIG-IP TMOS Shell (tmsh). When the system is in Appliance mode, an attacker could exploit this flaw to breach security boundaries, potentially compromising sensitive aspects of the network. It is crucial for users to update to a patched version, as those that have reached End of Technical Support (EoTS) have not been evaluated for this vulnerability.

References