This vulnerability (CVE-2026-42406) in F5 BIG-IP and BIG-IQ products involves improper privilege definition (CWE-267) where an attacker with the Certificate Manager role can modify configuration objects to execute arbitrary commands. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. Affected versions include 16.1.0, 17.1.0, 17.5.0, and 21.0.0. No patch or official remediation guidance is currently available from the vendor. The vulnerability is published and reserved as of April 2026, with no known exploits in the wild.

An attacker with the Certificate Manager role, which is a highly privileged authenticated role, can leverage this vulnerability to modify configuration objects and run arbitrary commands on the affected systems. This can lead to a complete compromise of confidentiality and integrity of the system. Availability is not impacted according to the CVSS vector. The vulnerability affects multiple supported versions of BIG-IP and BIG-IQ, potentially exposing critical network infrastructure components to compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, organizations should monitor F5's security advisories closely for updates. Until a fix is available, restrict access to the Certificate Manager role to trusted administrators only and consider additional compensating controls to limit the risk of privilege misuse.