CVE-2026-42406
High · 8.7CVSS
8.7
EPSS
0.3%
Published
May 13, 2026
CISA due date
—
The record
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility… CWE-267
- CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from… CWE-267
- CVE-2026-10090 A flaw was found in the Application Subscription controller… CWE-267
- CVE-2026-6816 An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the… CWE-267
- CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-267