A privilege escalation flaw exists in F5 BIG‑IP iControl REST and the TMOS Shell (tmsh). An attacker who is already authenticated and holds at least a Manager role can add configuration objects that grant them the ability to execute arbitrary commands on the device. This enables full compromise of the system, allowing the attacker to modify settings, exfiltrate data, or extend persistence. The weakness is an improper restriction of functions, as identified by CWE‑272.

The vulnerability affects F5 BIG‑IP systems. Specific version information is not provided in the advisory; however, any F5 BIG‑IP installation that has not applied the official patch should be considered at risk. Review the vendor advisory to determine if your particular deployment is impacted.

With a CVSS score of 8.6 the vulnerability is classified as high severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector requires authenticated access via the iControl REST API or tmsh console, so the attacker must already possess Manager‑level credentials or have compromised an account with those privileges. Once privileged, the attacker can create malicious configuration objects that will be invoked with system privileges, resulting in arbitrary command execution and full control of the device.