Home / Vulnerability Intelligence / CVE-2026-40061

CVE-2026-40061 - Vulnerability Analysis

HighCVSS: 8.7

Last Updated: May 13, 2026

BIG-IP DNS - Command Injection

Published: May 13, 2026Updated: May 13, 2026Remote Exploitable

Overview

BIG-IP DNS contains a command injection caused by an undisclosed iControl REST and tmsh command, letting authenticated Resource Administrator or Administrator execute arbitrary system commands with higher privileges, exploit requires authenticated admin roles.

Severity & Score

Severity: High

CVSS Score: 8.7

EPSS Score: 5.3%(Probability of exploitation in next 30 days)

Impact

Authenticated administrators can execute arbitrary system commands with elevated privileges, potentially compromising the entire system.

Mitigation

Update to the latest supported version.

References

https://my.f5.com/manage/s/article/K000160788

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 13, 2026

🟠 CVE-2026-40061 - High (8.7) When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40061/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-40061
Severity: High
CVSS Score: 8.7
Type: command_injection
Status: unconfirmed
EPSS: 5.3%
Social Posts: 2

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS Score

5.3%Probability of exploitation in the next 30 days