PatchTheCVECVE-2026-42924: An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration
34
Routine
HIGH 8.7UPGRADEUPGRADEUPGRADE
CVE-2026-42924 is a high-severity flaw (CVSS 8.7) affecting big-ip access policy manager, big-ip advanced firewall manager, big-ip advanced web application firewall. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.7 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 84%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-05-13 |
| Last modified | 2026-10-26 |
Publisher (CNA): F5 Networks · Vendor: f5
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
f5 big-ip access policy manager UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-access-policy-manager || rpm -q big-ip-access-policy-manager || big-ip-access-policy-manager --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-access-policy-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-access-policy-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-access-policy-manager
sudo apt install big-ip-access-policy-manager=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-access-policy-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-access-policy-manager
sudo dnf downgrade big-ip-access-policy-manager-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-access-policy-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
f5 big-ip advanced firewall manager UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-advanced-firewall-manager || rpm -q big-ip-advanced-firewall-manager || big-ip-advanced-firewall-manager --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-advanced-firewall-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-advanced-firewall-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-advanced-firewall-manager
sudo apt install big-ip-advanced-firewall-manager=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-advanced-firewall-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-advanced-firewall-manager
sudo dnf downgrade big-ip-advanced-firewall-manager-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-advanced-firewall-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
f5 big-ip advanced web application firewall UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-advanced-web-application-firewall || rpm -q big-ip-advanced-web-application-firewall || big-ip-advanced-web-application-firewall --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-advanced-web-application-firewall
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-advanced-web-application-firewall
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-advanced-web-application-firewall
sudo apt install big-ip-advanced-web-application-firewall=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-advanced-web-application-firewall
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-advanced-web-application-firewall
sudo dnf downgrade big-ip-advanced-web-application-firewall-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-advanced-web-application-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
f5 big-ip analytics UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-analytics || rpm -q big-ip-analytics || big-ip-analytics --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-analytics
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-analytics
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-analytics
sudo apt install big-ip-analytics=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-analytics
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-analytics
sudo dnf downgrade big-ip-analytics-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-analytics
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
f5 big-ip application acceleration manager UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-application-acceleration-manager || rpm -q big-ip-application-acceleration-manager || big-ip-application-acceleration-manager --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-application-acceleration-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-application-acceleration-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-application-acceleration-manager
sudo apt install big-ip-application-acceleration-manager=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-application-acceleration-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-application-acceleration-manager
sudo dnf downgrade big-ip-application-acceleration-manager-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-application-acceleration-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
f5 big-ip application security manager UPGRADE
Affected: 21.0.0 · >= 17.1.0 and <= 17.1.3 · >= 17.5.0 and <= 17.5.1 · >= 16.1.0 and <= 16.1.6
Fixed in: newer than 17.5.1
Safe to downgrade to: a release before 16.1.0
1. Check installed version
apt-cache policy big-ip-application-security-manager || rpm -q big-ip-application-security-manager || big-ip-application-security-manager --version
2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade big-ip-application-security-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade big-ip-application-security-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 16.1.0 (Debian / Ubuntu)
apt-cache madison big-ip-application-security-manager
sudo apt install big-ip-application-security-manager=<VERSION_BEFORE_16.1.0>
sudo apt-mark hold big-ip-application-security-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list big-ip-application-security-manager
sudo dnf downgrade big-ip-application-security-manager-<VERSION_BEFORE_16.1.0>
sudo dnf versionlock add big-ip-application-security-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-42924?
big-ip access policy manager: upgrade to newer than 17.5.1; big-ip advanced firewall manager: upgrade to newer than 17.5.1; big-ip advanced web application firewall: upgrade to newer than 17.5.1. Exact commands for each OS are on this page.
Is CVE-2026-42924 being exploited?
CVE-2026-42924 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-42924 affect?
CVE-2026-42924 affects big-ip access policy manager, big-ip advanced firewall manager, big-ip advanced web application firewall. Severity is high (CVSS 8.7). An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Supp
How urgent is CVE-2026-42924?
Priority 34/100. High severity
Software pages
Related CVEs
- CVE-2026-94127 CRITICAL 9.8 EXPLOITED UPGRADE F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability