This vulnerability (CVE-2026-41225) in F5 BIG-IP arises from incorrect use of privileged APIs (CWE-648) in the iControl REST interface. An attacker with Manager-level authentication can abuse the API to create configuration objects that facilitate arbitrary command execution on the device. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. No patch or official remediation guidance is currently available from the vendor. The vulnerability is published and reserved under F5's assigner but no exploit in the wild is known.

Successful exploitation allows a highly privileged attacker to execute arbitrary commands on the BIG-IP system, potentially leading to full compromise of confidentiality, integrity, and availability of the device and its managed network traffic. This could disrupt network operations or allow further lateral movement within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently documented, organizations should restrict Manager-level access to trusted administrators only and monitor for suspicious activity. Follow F5's official advisories for updates on patches or mitigations.