This vulnerability (CVE-2026-42930) involves a path traversal flaw in F5 BIG-IP devices operating in Appliance mode. An attacker with Administrator privileges can bypass the restrictions imposed by Appliance mode, potentially gaining unauthorized access or control beyond intended limits. The issue is tracked under CWE-35 and affects several recent BIG-IP versions. The CVSS v3.1 score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity with scope change. No vendor advisory or patch information is currently available.

An authenticated administrator on a vulnerable BIG-IP system can bypass Appliance mode restrictions, potentially leading to unauthorized access or modification of system components beyond the intended appliance constraints. This could compromise the confidentiality and integrity of the system. Availability impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and monitor for unusual activity related to Appliance mode settings. Avoid running unsupported or End of Technical Support versions as they are not evaluated for this vulnerability.