PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40061 F5 CVE debrief

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command in BIG-IP DNS, which allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. This vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

Vendor
F5
Product
BIG-IP
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-29
Advisory published
2026-05-13
Advisory updated
2026-06-29

Who should care

Organizations using BIG-IP DNS, particularly those with Appliance mode deployments, should be concerned about this vulnerability. Attackers with authenticated access and the Resource Administrator or Administrator role could exploit this vulnerability to execute system commands with elevated privileges, potentially leading to unauthorized access and control.

Technical summary

The vulnerability exists in the iControl REST and BIG-IP TMOS Shell (tmsh) commands of BIG-IP DNS. An authenticated attacker with specific roles can execute arbitrary system commands with higher privileges. This could lead to a security boundary crossing in Appliance mode deployments. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Immediate attention is required to address this HIGH-severity vulnerability. Organizations should prioritize patching or mitigating this vulnerability to prevent potential exploitation.

Recommended defensive actions

  • Apply patches or updates provided by F5 to address the vulnerability.
  • Implement compensating controls to monitor and restrict access to BIG-IP DNS systems.
  • Conduct thorough inventory checks to identify and update vulnerable systems.
  • Enforce strict access controls and role-based access to limit the attack surface.
  • Monitor system logs and network activity for suspicious commands or behavior.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its severity, and affected versions. F5 has provided mitigation and vendor advisory information. The vulnerability is considered HIGH severity with a CVSS score of 8.5.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40061 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40061

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40061 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40061

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.