CVE-2026-42058 is a vulnerability in F5 BIG-IP where an authenticated attacker can exploit incorrect permission assignments in the iControl REST interface to leak local user account names. The issue is classified under CWE-732, indicating improper permission assignment for a critical resource. The vulnerability affects multiple BIG-IP versions and has a CVSS 3.1 base score of 4.3, reflecting a medium impact primarily on confidentiality. No official patch or remediation guidance is currently available, and the affected versions are not cloud services, so remediation depends on vendor updates.

An authenticated attacker may obtain local user account names from the BIG-IP system via undisclosed requests to the iControl REST interface. This information leak could aid in further reconnaissance but does not directly compromise system integrity or availability. The impact is limited to confidentiality of user account names.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Restricting access to the iControl REST interface to trusted users and networks may reduce exposure.