CVE-2026-34176

HighCVSS 8.7

Published: 13/05/2026(UTC)Updated: 29/06/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.69%

48th percentile - higher than 48% of all known CVEs

Summary

In Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. Successful exploitation allows an attacker to cross a security boundary.

Risk Assessment

The organization faces the risk of unauthorized system access and potential takeover of the appliance, leading to data integrity and confidentiality breaches.

Recommendation

It is recommended to immediately apply vendor-provided patches and restrict access to the iControl REST interface to trusted networks and users only.

Other vulnerabilities in F5 iControl REST

CVE-2026-24464Medium
In Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint. It allows an authenticated attacker with administrator role privileges to cross a security boundary and delete files.

Original NVD description (English source)

When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.