CVE-2026-42406 is a vulnerability in F5 BIG-IP and BIG-IQ systems where an attacker with the Certificate Manager role, which is a highly privileged authenticated role, can modify configuration objects in a way that allows execution of arbitrary commands. This arises due to unsafe privilege definitions (CWE-267). The vulnerability affects several versions of BIG-IP and BIG-IQ, specifically 21.0.0, 17.5.0, 17.1.0, and 16.1.0. The CVSS v3.1 score is 8.7, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation level has been published yet, and no known exploits have been reported in the wild.

An attacker with the Certificate Manager role can leverage this vulnerability to modify configuration objects and execute arbitrary commands, potentially leading to full compromise of the affected system's confidentiality and integrity. Availability is not impacted. Since the attacker must already have a highly privileged authenticated role, the vulnerability primarily escalates the risk associated with that role's permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor access to the Certificate Manager role to limit exposure. No vendor-provided patches or temporary fixes are currently available.