A flaw in F5 BIG‑IP and BIG‑IQ permits a highly privileged, authenticated attacker holding at least a Certificate Manager role to alter configuration objects that enable the execution of arbitrary commands. The vulnerability is classified as CWE‑250, representing an elevation of privilege that can lead to arbitrary code execution and compromise system integrity and confidentiality.

The issue affects F5’s BIG‑IP and BIG‑IQ. No explicit version range appears in the advisory. The description states that End‑of‑Technical‑Support releases are not evaluated, implying that all currently supported releases may be vulnerable. Based on the description, it is inferred that all updated and maintained versions of these products are potentially impacted.

The CVSS score of 8.5 signals high severity. EPSS is not provided and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with at least the Certificate Manager role, so it is likely confined to environments where such privileged accounts exist. The likely attack vector is a privileged local or internal access scenario, though no public remote exploit is referenced.