CVE-2026-42408: BIG-IP DNS tmsh vulnerability

Q: What is the severity of CVE-2026-42408?

CVE-2026-42408 is considered to have a high severity due to the potential for a highly privileged authenticated attacker to access sensitive information.

Q: How do I fix CVE-2026-42408?

To fix CVE-2026-42408, it is recommended to upgrade to the latest version of BIG-IP DNS that is not affected by this vulnerability.

Q: What versions are affected by CVE-2026-42408?

CVE-2026-42408 affects versions of F5 Networks BIG-IP DNS that are still within their support lifecycle.

Q: Can an unauthenticated attacker exploit CVE-2026-42408?

No, an unauthenticated attacker cannot exploit CVE-2026-42408 as it requires high privileges and authenticated access.

Q: What type of information can be leaked through CVE-2026-42408?

CVE-2026-42408 may allow a highly privileged authenticated attacker to view sensitive configuration or operational data.

Published May 13, 2026

Updated

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

64 affected components

F5 Networks BIG-IP DNS

F5 BIG-IP Access Policy Manager>=16.1.0<=16.1.6

F5 BIG-IP Advanced Firewall Manager>=16.1.0<=16.1.6

F5 Big-ip Advanced Web Application Firewall>=16.1.0<=16.1.6

F5 BIG-IP Analytics>=16.1.0<=16.1.6

F5 Big-ip Application Acceleration Manager>=16.1.0<=16.1.6

F5 BIG-IP Application Security Manager>=16.1.0<=16.1.6

F5 Big-ip Application Visibility And Reporting>=16.1.0<=16.1.6

F5 Big-ip Automation Toolchain>=16.1.0<=16.1.6

F5 Big-ip Carrier-grade Nat>=16.1.0<=16.1.6

F5 BIG-IP Container Ingress Services>=16.1.0<=16.1.6

F5 Big-ip Ddos Hybrid Defender>=16.1.0<=16.1.6

F5 Big-ip Domain Name System>=16.1.0<=16.1.6

F5 BIG-IP Edge Gateway>=16.1.0<=16.1.6

F5 Big-ip Fraud Protection Service>=16.1.0<=16.1.6

F5 Big-ip Global Traffic Manager>=16.1.0<=16.1.6

F5 Big-ip Link Controller>=16.1.0<=16.1.6

F5 Big-ip Local Traffic Manager>=16.1.0<=16.1.6

F5 Big-ip Policy Enforcement Manager>=16.1.0<=16.1.6

F5 BIG-IP SSL Orchestrator>=16.1.0<=16.1.6

F5 Big-ip Webaccelerator>=16.1.0<=16.1.6

F5 Big-ip Websafe>=16.1.0<=16.1.6

F5 BIG-IP Access Policy Manager>=17.1.0<=17.1.3

F5 BIG-IP Access Policy Manager>=17.5.0<=17.5.1

F5 BIG-IP Advanced Firewall Manager>=17.1.0<=17.1.3

F5 BIG-IP Advanced Firewall Manager>=17.5.0<=17.5.1

F5 Big-ip Advanced Web Application Firewall>=17.1.0<=17.1.3

F5 Big-ip Advanced Web Application Firewall>=17.5.0<=17.5.1

F5 BIG-IP Analytics>=17.1.0<=17.1.3

F5 BIG-IP Analytics>=17.5.0<=17.5.1

F5 Big-ip Application Acceleration Manager>=17.1.0<=17.1.3

F5 Big-ip Application Acceleration Manager>=17.5.0<=17.5.1

F5 BIG-IP Application Security Manager>=17.1.0<=17.1.3

F5 BIG-IP Application Security Manager>=17.5.0<=17.5.1

F5 Big-ip Application Visibility And Reporting>=17.1.0<=17.1.3

F5 Big-ip Application Visibility And Reporting>=17.5.0<=17.5.1

F5 Big-ip Automation Toolchain>=17.1.0<=17.1.3

F5 Big-ip Automation Toolchain>=17.5.0<=17.5.1

F5 Big-ip Carrier-grade Nat>=17.1.0<=17.1.3

F5 Big-ip Carrier-grade Nat>=17.5.0<=17.5.1

F5 BIG-IP Container Ingress Services>=17.1.0<=17.1.3

F5 BIG-IP Container Ingress Services>=17.5.0<=17.5.1

F5 Big-ip Ddos Hybrid Defender>=17.1.0<=17.1.3

F5 Big-ip Ddos Hybrid Defender>=17.5.0<=17.5.1

F5 Big-ip Domain Name System>=17.1.0<=17.1.3

F5 Big-ip Domain Name System>=17.5.0<=17.5.1

F5 BIG-IP Edge Gateway>=17.1.0<=17.1.3

F5 BIG-IP Edge Gateway>=17.5.0<=17.5.1

F5 Big-ip Fraud Protection Service>=17.1.0<=17.1.3

F5 Big-ip Fraud Protection Service>=17.5.0<=17.5.1

F5 Big-ip Global Traffic Manager>=17.1.0<=17.1.3

F5 Big-ip Global Traffic Manager>=17.5.0<=17.5.1

F5 Big-ip Link Controller>=17.1.0<=17.1.3

F5 Big-ip Link Controller>=17.5.0<=17.5.1

F5 Big-ip Local Traffic Manager>=17.1.0<=17.1.3

F5 Big-ip Local Traffic Manager>=17.5.0<=17.5.1

F5 Big-ip Policy Enforcement Manager>=17.1.0<=17.1.3

F5 Big-ip Policy Enforcement Manager>=17.5.0<=17.5.1

F5 BIG-IP SSL Orchestrator>=17.1.0<=17.1.3

F5 BIG-IP SSL Orchestrator>=17.5.0<=17.5.1

F5 Big-ip Webaccelerator>=17.1.0<=17.1.3

F5 Big-ip Webaccelerator>=17.5.0<=17.5.1

F5 Big-ip Websafe>=17.1.0<=17.1.3

F5 Big-ip Websafe>=17.5.0<=17.5.1

Event History

May 13, 2026

CVE Published

via MITRE·02:12 PM

Data Sourced

via MITRE·02:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-42408?

CVE-2026-42408 is considered to have a high severity due to the potential for a highly privileged authenticated attacker to access sensitive information.

How do I fix CVE-2026-42408?

To fix CVE-2026-42408, it is recommended to upgrade to the latest version of BIG-IP DNS that is not affected by this vulnerability.

What versions are affected by CVE-2026-42408?