PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20916 F5 CVE debrief

CVE-2026-20916 is a highly severe vulnerability affecting F5's BIG-IQ Centralized Management. An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint. The vulnerability has a CVSS score of 7.2 and is classified as HIGH. F5 has provided mitigation guidance for this issue. Users should review and apply the necessary patches or workarounds to prevent exploitation.

Vendor
F5
Product
BIG-IQ
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-29
Advisory published
2026-05-13
Advisory updated
2026-06-29

Who should care

Organizations using F5's BIG-IQ Centralized Management should prioritize patching this vulnerability. Security teams and system administrators responsible for F5 products should assess their exposure and take immediate action to mitigate the risk.

Technical summary

CVE-2026-20916 is a vulnerability in F5's BIG-IQ Centralized Management that allows an authenticated iControl REST user with low privileges to create or modify arbitrary files. This can be done through an undisclosed iControl REST endpoint. The vulnerability's CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weakness associated with this vulnerability is CWE-22.

Defensive priority

This vulnerability should be prioritized for immediate patching due to its high severity and potential impact. Organizations should review F5's mitigation guidance and apply necessary patches or workarounds.

Recommended defensive actions

  • Review and apply F5's mitigation guidance for CVE-2026-20916
  • Assess exposure and prioritize patching for BIG-IQ Centralized Management
  • Monitor system logs for suspicious activity related to iControl REST endpoints
  • Implement compensating controls to limit access to sensitive files and endpoints
  • Verify that all iControl REST users have the minimum required privileges

Evidence notes

The CVE record and NVD detail provide information on the vulnerability's impact and affected products. F5's mitigation guidance is available through their support article K000158029. The vulnerability is classified as CWE-22, and its CVSS score is 7.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20916 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20916

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20916 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20916

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.