This vulnerability (CVE-2026-41954) in F5 BIG-IP allows an authenticated attacker with resource administrator privileges to access sensitive information via an undisclosed iControl REST endpoint and the TMOS Shell (tmsh) command. The issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability affects multiple versions of BIG-IP (21.0.0, 17.5.0, 17.1.0, 16.1.0). The CVSS v3.1 base score is 4.9, with network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An attacker with resource administrator role privileges can view sensitive information that should be protected. This exposure could lead to unauthorized disclosure of confidential data. There is no reported impact on integrity or availability. The vulnerability does not appear to be exploitable by unauthenticated attackers or those with lower privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is indicated, organizations should monitor F5's advisories for updates. Restrict resource administrator role assignments to trusted personnel only and review access controls to limit exposure. No additional vendor-recommended mitigations are available at this time.