F5 BIG-IP, BIG-IQ CVE-2026-42406: Critical RCE for Privileged Attackers

The National Vulnerability Database has disclosed CVE-2026-42406, a high-severity vulnerability affecting F5 BIG-IP and BIG-IQ systems. This flaw allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects, leading to arbitrary command execution. The CVSSv3.1 score is 8.7 (HIGH), with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.

This isn’t a zero-day for the masses, but it’s a critical internal threat. The attacker needs existing high-level authentication, meaning this is an escalation path for an insider threat or a post-compromise move for an external actor who’s already breached initial defenses. Gaining arbitrary command execution on these systems is a full compromise of the device, offering a powerful pivot point within the network. This isn’t just about data exfiltration; it’s about network control.

Defenders need to treat this as a serious privilege escalation and RCE risk. While specific affected product versions were not detailed by the National Vulnerability Database, organizations running F5 BIG-IP and BIG-IQ should prioritize reviewing access controls and logging for their Certificate Manager roles. Any suspicious activity from these accounts warrants immediate investigation. End-of-Technical-Support (EoTS) versions are, as always, not evaluated, but also pose their own unpatched risks.