SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2026-41954

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.

MEDIUM 6.9EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0
6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS
0.29% probability · 22th percentile
CISA KEV
Not listed
Weakness
CWE-200
Affected
f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip advanced web application firewall · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip application visibility and reporting · f5/big-ip automation toolchain · f5/big-ip carrier-grade nat · f5/big-ip container ingress services · f5/big-ip ddos hybrid defender · f5/big-ip domain name system · f5/big-ip edge gateway · f5/big-ip fraud protection service · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip ssl orchestrator · f5/big-ip webaccelerator · +2 more
Source
f5sirt@f5.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.