This vulnerability (CVE-2026-41953) in F5 BIG-IP involves improper neutralization of special elements used in commands (CWE-77), enabling command injection. An attacker with Resource Administrator privileges can exploit this flaw to modify configuration objects, resulting in privilege escalation. The CVSS 3.1 base score is 8.7, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability affects several BIG-IP versions but excludes those that have reached End of Technical Support. No vendor advisory or patch information is currently available.

Successful exploitation allows a highly privileged, authenticated attacker to escalate privileges by modifying configuration objects on affected BIG-IP systems. This can compromise confidentiality and integrity of the system. Availability impact is not indicated. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Resource Administrator privileges to trusted personnel only and monitor for suspicious configuration changes. No official patch or workaround is currently documented.