CVE-2026-20916: BIG-IQ iControl REST vulnerability
Published May 13, 2026
·Updated
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
2 affected components
F5 Networks BIG-IQ
F5 BIG-IQ Centralized Management=8.4.0
Event History
May 13, 2026
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-20916?
The severity of CVE-2026-20916 is rated as high with a score of 7.2.
2
How do I fix CVE-2026-20916?
To fix CVE-2026-20916, ensure that you update to the latest version of F5 Networks BIG-IQ that is not End of Technical Support.
3
What is the impact of CVE-2026-20916?
CVE-2026-20916 allows an authenticated iControl REST user with low privileges to create or modify arbitrary files.
4
Which systems are affected by CVE-2026-20916?
CVE-2026-20916 affects F5 Networks BIG-IQ Centralized Management systems.
5
What kind of vulnerability is CVE-2026-20916?
CVE-2026-20916 is categorized as a Path Traversal vulnerability.