CVE WatchOct 26, 2026

CVE-2026-41217

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrat

CVSS

7.9

High

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: May 13, 2026 · Last modified: Oct 26, 2026 · CWE-732

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-10-042026-10-31

Technical description

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Official references

my.f5.comhttps://my.f5.com/manage/s/article/K000161107

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-68591—

—

———In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.4h CVE-2026-1114995.5 MED

3.2%

——1Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.3d CVE-2026-118574—

2.8%

——1Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.2d CVE-2026-1070609.1 CRI

20.1%

——6Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.2d CVE-2026-1070557.5 HIG

17.3%

——5Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.2d CVE-2026-1070477.5 HIG

37.8%

——11Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.2d