This vulnerability (CVE-2026-34176) in F5 BIG-IP occurs when running in Appliance mode and involves improper neutralization of special elements in an OS command (CWE-78) through an authenticated remote command injection in an undisclosed iControl REST endpoint. The CVSS 3.1 base score is 8.7 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality and integrity. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. The vendor has not yet provided an official fix or remediation level, and no patch links are available. The vulnerability is published and reserved as of April and May 2026 respectively. No known exploits in the wild have been reported.

An attacker with authenticated access and high privileges can exploit this vulnerability to execute arbitrary OS commands on the affected BIG-IP appliance. This can lead to crossing security boundaries and result in complete compromise of confidentiality and integrity of the system. Availability impact is not indicated. The vulnerability affects multiple major versions of BIG-IP software. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, organizations should monitor F5's advisories closely. Restrict authenticated access to the iControl REST interface to trusted administrators only and consider additional network-level controls to limit exposure until a patch is available.