PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42406 F5 CVE debrief

CVE-2026-42406 is a high-severity vulnerability in F5 BIG-IP and BIG-IQ systems. A highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects to run arbitrary commands. This issue affects multiple F5 products across various versions. The CVSS score is 8.5, indicating a high level of severity.

Vendor
F5
Product
BIG-IP
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-23
Advisory published
2026-05-13
Advisory updated
2026-06-23

Who should care

Organizations using F5 BIG-IP and BIG-IQ systems, particularly those with highly privileged users or Certificate Manager roles, should prioritize patching this vulnerability. The ability to execute arbitrary commands could lead to significant compromise of the affected systems.

Technical summary

The vulnerability exists in various F5 BIG-IP and BIG-IQ products, allowing a highly privileged, authenticated attacker to modify configuration objects and run arbitrary commands. Affected products include BIG-IP Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, and others, across multiple version ranges. The Common Vulnerabilities and Exposures (CVE) score is 8.5, with a CVSS vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority due to high CVSS score and potential for significant system compromise.

Recommended defensive actions

  • Apply official patches from F5 as soon as possible.
  • Limit exposure by restricting access to highly privileged roles.
  • Monitor systems for suspicious activity.
  • Review and update configuration objects to prevent unauthorized modifications.
  • Implement compensating controls to detect and prevent command execution.

Evidence notes

The primary evidence for this vulnerability comes from the official CVE record and the National Vulnerability Database (NVD). The CVE score and details are based on the information provided by these sources. Affected products and versions are listed in the source item URL from the NVD. The vulnerability allows a highly privileged attacker to execute arbitrary commands, which could lead to significant compromise of the affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42406 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42406

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42406 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42406

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.