8.6 HighCWE-272
CVE-2026-39459
F5 BIG-IP vulnerability
F5BIG-IP
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
0.5%probability of exploitation in the next 30 days
Higher than 39% of scored CVEs
SeverityCVSS
8.6High
Description NVD
A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Coverage 1 article · 1 outlet
- F5 fixes NGINX heap overflow and iControl REST command injectionSecurityWeek · first in our coverage · mentions it in passing