CVE-2026-24464
When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.89%
- CWE
- CWE-35
- Published
- 2026-05-13
- Last modified
- 2026-05-13
Affected products
- F5 BIG-IP
- F5 BIG-IP
- F5 BIG-IP
- F5 BIG-IP
- F5 BIG-IP
Weakness type
Related vulnerabilities
- CVE-2026-20513 — In Audio HAL, there is a possible information disclosure due to improper input validation. This...
- CVE-2026-56089 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-59909 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-28157 — WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability
- CVE-2026-69109 — A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The...
- CVE-2026-13716 — Path Traversal: '.../...//' in Crafty Controller
- CVE-2026-59115 — Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
- CVE-2026-66695 — WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability