Vulnerability · Published May 13, 2026 · Assigned by f5

CVE-2026-28758BIG-IP iControl REST vulnerability

Medium 4.4

In plain English

A medium-severity security flaw in BIG-IP from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)<0.1%top 99.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products (as reported)

Vendor	Product	Versions
F5	BIG-IP	17.5.0 – before 17.5.1.417.1.0 – before 17.1.3.116.1.0 – before *

Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://my.f5.com/manage/s/article/K000158070 vendor-advisory, patch