This vulnerability (CVE-2026-42063) in F5 BIG-IP involves improper access control in the iControl SOAP interface, permitting authenticated users with elevated roles (Resource Administrator or Administrator) to download sensitive files. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high privileges required. The vulnerability does not affect confidentiality, integrity, or availability beyond unauthorized file disclosure. No official remediation or patch has been documented yet, and no known exploits have been reported.

An attacker with Resource Administrator or Administrator privileges can download sensitive files from the affected BIG-IP versions, potentially leading to unauthorized disclosure of sensitive information. There is no indication of impact on system integrity or availability. The vulnerability requires authenticated access with elevated privileges, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the iControl SOAP interface to trusted administrators only and monitor for any unusual file access activity by privileged users.