CVE-2026-28758 BIG-IP iControl REST vulnerability

What is CVE-2026-28758?

CVE-2026-28758 is a medium-severity vulnerability in F5 Big-Ip Domain Name System, published on 13 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Weakness: CWE-312

Which versions are affected by CVE-2026-28758?

It affects 1 product.

Products include F5 Big-Ip Domain Name System.

How do I fix CVE-2026-28758?

No fix has been published for CVE-2026-28758 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-28758 being exploited?

There is no known exploitation of CVE-2026-28758 in the wild and no public exploit code.

Other vulnerabilities in F5 Big-Ip Domain Name System

• CVE-2022-23013 Cross-site scripting in BIG-IP DNS & GTM High 8.8
• CVE-2026-40061 iControl REST and tmsh vulnerability High 8.5
• CVE-2022-41787 BIG-IP DNS Express vulnerability CVE-2022-41787 High 7.5
• CVE-2021-23032 Denial of service in BIG-IP DNS High 7.5
• CVE-2020-27717 Denial of service in BIG-IP DNS High 7.5

All F5 Big-Ip Domain Name System vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9657-qhh9-38mw.