CVE Feed

    Dashboard / CVE / CVE-2024-26026

    CVE-2024-26026

    An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published:May 8, 2024
    Last Modified:Sep 19, 2025
    EPS:May 8, 2024
    EPSS Score:0.8718
    CVSS Score:7.5

    Affected Products

    Vendor
    F5
    Product
    Big-ip Next Central Manager

    Exploits

    https://github.com/GRTMALDET/Big-IP-Next-CVE-2024-26026https://github.com/passwa11/CVE-2024-26026

    Related CVEs

    CVE-2025-54500 (CVSS 6.9) — An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in or…
    CVE-2025-36504 (CVSS 8.7) — When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an …
    CVE-2025-41399 (CVSS 8.7) — When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requ…
    CVE-2025-23413 (CVSS 6.7) — When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sen…
    CVE-2025-24319 (CVSS 7.1) — When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can c…
    CVE-2024-37028 (CVSS 6.3) — BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note:…
    CVE-2024-39809 (CVSS 8.9) — The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions …
    CVE-2024-41719 (CVSS 5.1) — When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credenti…
    CVE-2024-21793 (CVSS 7.5) — An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions…
    CVE-2024-33612 (CVSS 6.8) — An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attack…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High