CVE-2026-42930 HIGH

CVE-2026-42930: Appliance mode iControl REST vulnerability

Vendor F5
Product BIG-IP
Weakness CWE-35
Published May 13, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Key dates

02Disclosure timeline

May 13, 2026 CVE published
May 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-49296 WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability CVE-2025-46441 WordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerability CVE-2025-22205 Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla CVE-2025-58972 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerability CVE-2025-32585 WordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerability