CVE-2026-40462
iControl REST and tmsh vulnerability
At a glance Severity HIGH 7.1 EPSS EPSS 0.25 % · percentile 16 (2026-10-27) State PUBLISHED Published 2026-05-13 Updated 2026-05-13 Assigner f5 NVD status Analyzed Description Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · f5sirt@f5.com (Secondary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · f5sirt@f5.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1+44 more Affected products Product Versions F5 · BIG-IP unaffected 21.1.0 < * ; affected 21.0.0 < 21.0.0.1 ; affected 17.5.0 < 17.5.1.4 ; affected 17.1.0 < 17.1.3.1 ; affected 16.1.0 < *
References
Sources
