This vulnerability (CVE-2026-41953) in F5 BIG-IP involves improper neutralization of special elements used in commands (CWE-77), enabling command injection. An attacker with Resource Administrator privileges can exploit this to modify configuration objects, resulting in privilege escalation. The CVSS 3.1 score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. No patch or official remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation allows a highly privileged, authenticated attacker to escalate privileges by modifying configuration objects on BIG-IP systems. This could compromise confidentiality and integrity of the system configurations. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Resource Administrator privileges to trusted personnel only and monitor for suspicious configuration changes. No official remediation or temporary fix has been published by the vendor at this time.