Description

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:18.910Z",
  "pubdate": "2026-09-02T16:17:18.910Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within the Traffic Management User Interface (TMUI) of F5 BIG-IP systems. The security defect allows an authenticated user, regardless of their assigned role or permission level, to execute an undisclosed request that results in the creation of unauthorized administrative user accounts.\nThe vulnerability represents a critical control plane security risk. By successfully exploiting this flaw, an attacker with existing network access to the BIG-IP management interface and valid, low-privileged credentials can escalate their access to full administrative control over the appliance.\nBecause the vulnerability resides in the management interface rather than the data plane, the risk is limited to the system configuration and management layer. However, the ability to provision new administrative identities provides a clear path for persistent system compromise and full control over the device's management functions. Exploitation requires authenticated access, meaning the primary barrier is the initial compromise or acquisition of legitimate low-privileged user credentials.\nF5 has noted that versions reaching End of Technical Support (EoTS) are not evaluated for this vulnerability. Organizations must assess their firmware versions against current support status and vendor-provided security advisories to determine exposure.",
  "technicalDetails": "The vulnerability is situated within the Traffic Management User Interface (TMUI) component of BIG-IP. The root cause is identified as a broken access control mechanism that fails to properly validate the authorization of a user session when invoking specific administrative account creation routines. In a secure implementation, the interface should enforce strict role-based access control (RBAC) to ensure that only users with the Administrator role can modify user accounts or escalate privileges.\nThe exploitation flow begins with the attacker establishing a session with the BIG-IP management interface using existing, non-privileged credentials. Once authenticated, the attacker interacts with the TMUI via an undisclosed request—typically involving a specifically crafted HTTP request or API call directed at the backend services that handle user management. Because the underlying application logic lacks a comprehensive authorization check, the request is processed by the system as a valid administrative command.\nThe attack vector functions by bypassing the standard interface constraints that normally hide or disable account creation capabilities for non-administrative users. By sending the malicious request, the attacker triggers the backend process responsible for modifying the system's user database. The system then creates a new user account with administrative privileges as specified by the attacker's payload. This behavior effectively transforms a low-privileged session into one with full control over the management plane.\nPost-exploitation impact includes complete administrative access to the BIG-IP system. Since the attacker can create new administrative accounts, they can maintain persistent, undetected access even if their original user account is revoked or password-changed. This capability allows the attacker to bypass logging and monitoring mechanisms associated with their initial, low-privileged session. Furthermore, the attacker gains the ability to modify system configurations, extract sensitive data, intercept traffic management operations, and deploy additional persistent threats within the BIG-IP environment.\nThis is strictly a control plane vulnerability; there is no identified exposure through the data plane. The requirement for prior authentication implies that the attacker must have network-level access to the BIG-IP management interface and a set of credentials, potentially acquired through credential stuffing, phishing, or other initial access methods."
}