🔐 CVE Alert

CVE-2026-28758

MEDIUM 4.4

BIG-IP iControl REST vulnerability

CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CWE CWE-312
Vendor f5
Product big-ip
Published May 13, 2026
Last Updated May 13, 2026
Stay Ahead of the Next One

Get instant alerts for f5 big-ip

Be the first to know when new medium vulnerabilities affecting f5 big-ip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Affected Versions

F5 / BIG-IP
17.5.0 < 17.5.1.4 17.1.0 < 17.1.3.1 16.1.0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗
my.f5.com: https://my.f5.com/manage/s/article/K000158070

Credits

F5