CVE-2024-26026

—

CVSS 3.1

7.5 high

EPSS

7%p94

Published

May 8, 2024 (May 8, 2024)

Modified

Jun 17, 2026

Description

An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Vendors: f5
Products: big-ip next central manager
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (7.2%)

In the news5 stories

Week in review: Veeam fixes RCE flaw in backup management platform, Patch Tuesday forecast

Help Net SecurityMay 12, 00:00 UTC · May 12, 2024Vulnerability in the wildCVE-2024-29212 CVE-2024-4671 CVE-2024-21793+2 CVEs

Experts warn of BIG-IP Next Central Manager flaws that allow device takeover

Security AffairsMay 9, 08:30 UTC · May 9, 2024Exploit / PoC CVE-2024-26026 CVE-2024-21793

Critical F5 Central Manager Vulnerabilities Allow Enable Full Device Takeover

The Hacker NewsMay 9, 06:11 UTC · May 9, 2024Vulnerability in the wildCVE-2024-21793 CVE-2024-26026

Critical vulnerabilities in BIG-IP appliances leave big networks open to intrusion

Ars Technica · SecurityMay 8, 21:35 UTC · May 8, 2024Vulnerability in the wildCVE-2024-21793 CVE-2024-26026

F5 fixes BIG-IP Next Central Manager flaws with public PoCs (CVE-2024-21793, CVE-2024-26026)

Help Net SecurityMay 9, 00:00 UTC · May 9, 2024Vulnerability CVE-2024-21793 CVE-2024-26026