This vulnerability, tracked as CVE-2026-41957, involves CWE-502: Deserialization of Untrusted Data in the F5 BIG-IP and BIG-IQ Configuration utility. It enables an authenticated attacker to remotely execute code on affected systems. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions are 17.5.0, 17.1.0, and 16.1.0. The vendor has not published any patch or official remediation details at this time. The vulnerability is not related to cloud services and no known exploits have been reported.

Successful exploitation allows an authenticated attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected BIG-IP or BIG-IQ system. This impacts confidentiality, integrity, and availability of the system and its managed network traffic. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor F5's advisories closely. Until a patch is available, limit access to the BIG-IP and BIG-IQ Configuration utility to trusted administrators and consider additional network controls to reduce exposure.