Dashboard / CVE-2026-41954

CVE-2026-41954

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 59/100
Published: 2026-05-13 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness Classification (1)

Affected Software (43)

VendorProductVersion
f5 big-ip_access_policy_manager 17.1.0 – 17.1.3
f5 big-ip_access_policy_manager 21.0.0
f5 big-ip_advanced_firewall_manager 17.1.0 – 17.1.3
f5 big-ip_advanced_firewall_manager 21.0.0
f5 big-ip_advanced_web_application_firewall 17.1.0 – 17.1.3
f5 big-ip_advanced_web_application_firewall 21.0.0
f5 big-ip_analytics 17.1.0 – 17.1.3
f5 big-ip_analytics 21.0.0
f5 big-ip_application_acceleration_manager 17.1.0 – 17.1.3
f5 big-ip_application_acceleration_manager 21.0.0
f5 big-ip_application_security_manager 17.1.0 – 17.1.3
f5 big-ip_application_security_manager 21.0.0
f5 big-ip_application_visibility_and_reporting 17.1.0 – 17.1.3
f5 big-ip_application_visibility_and_reporting 21.0.0
f5 big-ip_automation_toolchain 17.1.0 – 17.1.3
f5 big-ip_automation_toolchain 21.0.0
f5 big-ip_carrier-grade_nat 17.1.0 – 17.1.3
f5 big-ip_carrier-grade_nat 21.0.0
f5 big-ip_container_ingress_services 17.1.0 – 17.1.3
f5 big-ip_container_ingress_services 21.0.0
f5 big-ip_ddos_hybrid_defender 17.1.0 – 17.1.3
f5 big-ip_ddos_hybrid_defender 21.0.0
f5 big-ip_domain_name_system 17.1.0 – 17.1.3
f5 big-ip_domain_name_system 21.0.0
f5 big-ip_edge_gateway 17.1.0 – 17.1.3
f5 big-ip_edge_gateway 21.0.0
f5 big-ip_fraud_protection_service 17.1.0 – 17.1.3
f5 big-ip_fraud_protection_service 21.0.0
f5 big-ip_global_traffic_manager 17.1.0 – 17.1.3
f5 big-ip_global_traffic_manager 21.0.0
Showing 30 of 43 entries

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.29%
Raw Score 0.002940
Percentile 22.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00294
2026-10-28
0.00294

Intelligence Sources

nvd ref →

External Links