CVE-2026-41954
Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVSS 4.0
- 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-26)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_advanced_web_application_firewall
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_application_visibility_and_reporting
- f5:big-ip_automation_toolchain
- f5:big-ip_carrier-grade_nat
- f5:big-ip_container_ingress_services
- f5:big-ip_ddos_hybrid_defender
- f5:big-ip_domain_name_system
- f5:big-ip_edge_gateway
- f5:big-ip_fraud_protection_service
- f5:big-ip_global_traffic_manager
- f5:big-ip_link_controller
- f5:big-ip_local_traffic_manager
- f5:big-ip_policy_enforcement_manager
- f5:big-ip_ssl_orchestrator
- f5:big-ip_webaccelerator
- f5:big-ip_websafe
- f5:big-iq_centralized_management