A vulnerability in F5 BIG‑IP allows a highly privileged, authenticated attacker with at least the Resource Administrator role to modify configuration objects, enabling the attacker to elevate privileges beyond what the role originally permits. This flaw can be used to compromise the integrity of the system configuration, potentially exposing or altering network traffic and services. The associated weakness is identified as CWE‑77, indicating untrusted input influencing system commands or configuration execution.

The affected systems are F5 BIG‑IP appliances that provide application delivery and security services. No specific version range is listed. Software versions which have reached End of Technical Support (EoTS) are not evaluated. Users should verify their deployed BIG‑IP version against F5’s advisory.

The CVSS score of 8.5 classifies this flaw as high severity. The absence of an EPSS score indicates that no exploitation data is available, and the vulnerability is not included in CISA’s KEV catalog. Exploitation requires authentication and possession of at least a Resource Administrator role, so it is not exploitable from an unauthenticated or unauthorised angle. The likely attack path involves an attacker first obtaining legitimate credentials with Resource Administrator rights, then using the flawed privilege escalation to modify configurations and gain elevated authority.