CVE-2026-66842: CWE-918 Server-Side Request Forgery (SSRF) in F5 BIG-IP

This vulnerability (CVE-2026-66842) in F5 BIG-IP involves a server-side request forgery (CWE-918) that enables an authenticated user with any role to escalate privileges by creating administrative accounts through an undisclosed request to the TMUI. The issue is limited to the control plane, with no data plane exposure. It affects certain versions of BIG-IP, specifically 17.1.0, 17.5.0, 21.0.0, and 21.1.0. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or official remediation level is currently provided, and no known exploits are reported in the wild. Versions that have reached End of Technical Support are not evaluated.

An authenticated attacker with network access to the BIG-IP management interface can escalate privileges by creating administrative user accounts, potentially gaining full control over the system's management functions. This could lead to complete compromise of the control plane, affecting system configuration and management, but does not impact the data plane or traffic handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the BIG-IP management interface to trusted users only and monitor for unauthorized administrative account creation attempts. Follow any additional guidance provided by F5 in their security advisories.