TI-2026-22957 Aliases CVE-2026-28758 GHSA-9657-qhh9-38mw

BIG-IP iControl REST vulnerability

LOW 28CWE-312Published 2026-05-13 · Updated 2026-05-13

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00083 0th percentileScored 2026-11-07

Fix Fixed BIG-IP (F5): 21.0.0, 17.5.1.4, 17.1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
F5	BIG-IP	17.5.0 to before 17.5.1.4; 17.1.0 to before 17.1.3.1; 16.1.0 and later	21.0.0, 17.5.1.4, 17.1.3.1	Patch available	CNA

BIG-IP VendorF5 Affected 17.5.0 to before 17.5.1.4; 17.1.0 to before 17.1.3.1; 16.1.0 and later Fixed in 21.0.0, 17.5.1.4, 17.1.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:big-ip_domain_name_system::::::::	16.1.0 – 16.1.6; 17.1.0 to before 17.1.3.1; 17.5.0 – 17.5.1	Vulnerable	F5

cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 16.1.0 – 16.1.6; 17.1.0 to before 17.1.3.1; 17.5.0 – 17.5.1 Vulnerable ·F5

Remediation

Fix · CNA BIG-IP (F5) Fixed in 21.0.0, 17.5.1.4, 17.1.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-13
F5 BIG-IP 17.1.3.1, 17.5.1.4
9 records Highest priority Priority MEDIUM 4 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-29357 BIG-IP SSL/TLS vulnerabilityPriority MEDIUM 44
- TI-2026-30351 BIG-IP TMM VulnerabilityPriority MEDIUM 43
- TI-2026-29836 BIG-IP HTTP/2 Layer 7 Dos Protection vulnerabilityPriority MEDIUM 43
Show all 9 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-28758
2026-10-03 Alias added: GHSA-9657-qhh9-38mw

References

Patch 1

https://my.f5.com/manage/s/article/K000158070

TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2023-25231 BIG-IP Configuration utility authenticated SQL injection vulnerability KEVCVSS 3.1HIGH 8.8

See all 468 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences