CVE-2026-42919

MediumCVSS 6.7/10Last modified Jun 18, 2026

Description

A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-42922.7An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editabl CVE-2026-429207.5When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic CVE-2026-429235.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negativ CVE-2026-429248.7An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP CVE-2026-429265.8When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker m CVE-2026-429298.3Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.CVE-2026-42935.3The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the vict CVE-2026-429308.7When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restriction CVE-2026-429316.5Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint CVE-2026-429325.3Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable CVE-2026-4293310.0Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use a CVE-2026-429344.8NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map a