CVE-2026-20916— BIG-IQ iControl REST vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20916
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BIG-IQ iControl REST vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
F5 BIG-IQ 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
F5 BIG-IQ是美国F5公司的一套基于软件的云管理解决方案。该方案支持跨公共和私有云、传统数据中心和混合环境部署应用交付和网络服务。 F5 BIG-IQ存在路径遍历漏洞，该漏洞源于低权限的iControl REST用户可通过未公开的端点创建或修改任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-20916
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20916
请登录查看更多情报信息。
Same Patch Batch · F5 · 2026-05-13 · 51 CVEs total
| CVE-2026-41225 | 9.1 CRITICAL | iControl REST vulnerability |
| CVE-2026-41957 | 8.8 HIGH | BIG-IP and BIG-IQ Configuration utility vulnerability |
| CVE-2026-40061 | 8.7 HIGH | iControl REST and tmsh vulnerability |
| CVE-2026-42930 | 8.7 HIGH | Appliance mode iControl REST vulnerability |
| CVE-2026-34176 | 8.7 HIGH | Knowledge Appliance mode iControl REST vulnerability |
| CVE-2026-32673 | 8.7 HIGH | BIG-IP scripted monitor vulnerability |
| CVE-2026-42945 | 8.1 HIGH | NGINX ngx_http_rewrite_module vulnerability |
| CVE-2026-41217 | 7.9 HIGH | BIG-IP tmsh vulnerability |
| CVE-2026-42920 | 7.5 HIGH | BIG-IP DTLS Vulnerability |
| CVE-2026-39455 | 7.5 HIGH | BIG-IP Configuration utility vulnerability |
| CVE-2026-41218 | 7.5 HIGH | BIG-IP PEM iRules vulnerability |
| CVE-2026-40423 | 7.5 HIGH | BIG-IP SIP profile vulnerability |
| CVE-2026-40067 | 7.5 HIGH | BIG-IP APM Vulnerability |
| CVE-2026-39458 | 7.5 HIGH | BIG-IP DNS Cache vulnerability |
| CVE-2026-40629 | 7.5 HIGH | BIG-IP SSL/TLS vulnerability |
| CVE-2026-40618 | 7.5 HIGH | BIG-IP SSL/TLS vulnerability |
| CVE-2026-41956 | 7.5 HIGH | BIG-IP TMM Vulnerability |
| CVE-2026-40060 | 7.5 HIGH | BIG-IP Advanced WAF and ASM vulnerability |
| CVE-2026-41227 | 7.5 HIGH | BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability |
| CVE-2026-42409 | 7.5 HIGH | BIG-IP HTTP/2 vulnerability |
Showing top 20 of 51 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: F5
Same weakness: CWE-22
- CVE-2026-44565
Open WebUI: Open WebUI Arbitrary File Write, Delete via Path - CVE-2026-44566
Open WebUI: Arbitrary File Upload and Path Traversal - CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite du - CVE-2026-44641
Microsoft APM: plugin.json component paths escape plugin roo - CVE-2026-41552
Path Traversal in PDF Export Module
V. Comments for CVE-2026-20916
No comments yet