CVE-2024-26026
published 2024-05-08CVE-2024-26026: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS)…
PriorityP355high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
7.16%
93.6th percentile
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_next_central_manager | — | — |
| f5 | big-ip_next_central_manager | >= 20.0.1 < 20.2.0 | 20.2.0 |
Detection & IOCsextracted from sources · hover to see the quote
url/api/login
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS F5 BIG-IP Next Central Manager SQL Injection (CVE-2024-26026)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/login"; startswith; http.content_type; content:"application/json"; http.request_body; content:"|22|provider_name|22 3a|"; fast_pattern; pcre:"/^\x20?\x22[^\x22]*(?:(?:S(?:HOW\x20(?:C(?:UR(?:DAT|TIM)E|HARACTER\x20SET)|(?:VARI|T)ABLES)|ELECT\x20(?:FROM|USER))|U(?:NION\x20SELEC|PDATE\x20SE)T|DELETE\x20FROM|INSERT\x20INTO)|S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\x2f\*.+\*\x2f)/Ri"; reference:url,eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/; reference:cve,2024-26026; classtype:web-application-attack; sid:2056183; rev:2; metadata:affected_product F5, attack_target Server, tls_state plaintext, created_at 2024_09_25, cve CVE_2024_26026, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2024_11_25, reviewed_at 2025_08_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
|22|provider_name|22 3a|
- →The SQL injection is delivered via HTTP POST to the /api/login URI endpoint of the BIG-IP Next Central Manager API; detection should focus on POST requests to this path containing a JSON body with a 'provider_name' key.
- →The injected payload in the provider_name JSON field contains classic SQL injection keywords: SELECT FROM, UNION SELECT, INSERT INTO, DELETE FROM, UPDATE SET, SHOW TABLES/VARIABLES/CHARACTER SET, and inline comment sequences (/* ... */).
- →Successful exploitation allows unauthenticated remote attackers to gain full administrative control of the BIG-IP Next Central Manager and create rogue accounts on managed BIG-IP Next assets that are not visible from the Central Manager UI — monitor for unexpected admin account creation on managed assets. ↗
- →The vulnerability is exploitable via the administrative UI; restrict Next Central Manager management interface access to trusted users over a secure network as a temporary mitigation. ↗
- →Over 10,000 F5 BIG-IP devices with management ports exposed online are tracked by Shodan — use this as a hunting pivot to identify exposed instances. ↗
- ·Only BIG-IP Next Central Manager versions 20.0.1 through 20.2.0 are affected; software versions that have reached End of Technical Support (EoTS) are not evaluated. ↗
- ·The Snort/Suricata rule (ET sid:2056183) is scoped to plaintext (non-TLS) traffic only; encrypted management traffic will not be detected by this signature.
- ·At time of disclosure, there was no evidence of in-the-wild exploitation of CVE-2024-26026, though a public proof-of-concept exploit was released by Eclypsium. ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fj43-9cjj-qw2v: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI)
ghsa_unreviewed·2024-05-08
CVE-2024-26026 [HIGH] CWE-200 GHSA-fj43-9cjj-qw2v: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI)
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
F5
CVE-2024-26026: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI)
vendor_f5·2024-05-08·CVSS 7.5
CVE-2024-26026 [HIGH] CWE-89 CVE-2024-26026: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI)
CVE-2024-26026: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI)
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected Products: BIG-IP Next Central Manager
Affected Versions: 20.0.1 - 20.2.0
F5 Advisory Articles: K000138733
F5 References: https://my.f5.com/manage/s/article/K000138733
Suricata
ET WEB_SPECIFIC_APPS F5 BIG-IP Next Central Manager SQL Injection (CVE-2024-26026)
suricata·2024-09-25·CVSS 7.5
CVE-2024-26026 [HIGH] ET WEB_SPECIFIC_APPS F5 BIG-IP Next Central Manager SQL Injection (CVE-2024-26026)
ET WEB_SPECIFIC_APPS F5 BIG-IP Next Central Manager SQL Injection (CVE-2024-26026)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS F5 BIG-IP Next Central Manager SQL Injection (CVE-2024-26026)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/login"; startswith; http.content_type; content:"application/json"; http.request_body; content:"|22|provider_name|22 3a|"; fast_pattern; pcre:"/^\x20?\x22[^\x22]*(?:(?:S(?:HOW\x20(?:C(?:UR(?:DAT|TIM)E|HARACTER\x20SET)|(?:VARI|T)ABLES)|ELECT\x20(?:FROM|USER))|U(?:NION\x20SELEC|PDATE\x20SE)T|DELETE\x20FROM|INSERT\x20INTO)|S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\x2f\*.+\*\x2f)/Ri"; reference:url,eclypsiu
No public exploits indexed.
Checkpoint
13th May – Threat Intelligence Report
blogs_checkpoint·2024-05-13
CVE-2024-4671 13th May – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 13th May – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 13th May, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Shared Services Connected Ltd, a payroll contractor for the UK Ministry of Defense has been breached, presumably by China. Around 270k records that include names and bank details of both current and past armed forces members were exposed.
US major healthcare operator Ascension, which operates 140 hospitals in 19 states, has disc
Tenable
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
blogs_tenable·2024-05-09·CVSS 7.5
[HIGH] CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
New BIG-IP Next Central Manager bugs allow device takeover
blogs_bleepingcomputer·2024-05-08·CVSS 7.5
CVE-2024-26026 [HIGH] New BIG-IP Next Central Manager bugs allow device takeover
## New BIG-IP Next Central Manager bugs allow device takeover
## Sergiu Gatlan
F5 has fixed two high-severity BIG-IP Next Central Manager vulnerabilities, which can be exploited to gain admin control and create hidden rogue accounts on any managed assets.
Next Central Manager allows administrators to control on-premises or cloud BIG-IP Next instances and services via a unified management user interface.
The flaws are an SQL injection vulnerability ( CVE-2024-26026 ) and an OData injection vulnerability ( CVE-2024-21793 ) found in the BIG-IP Next Central Manager API that would allow unauthenticated attackers to execute malicious SQL statements on unpatched devices remotely.
SQL injection attacks involve injecting malicious SQL queries into input fields or parameters in database queries
Greynoiseio
NoiseLetter May 2024
blogs_greynoiseio
NoiseLetter May 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
2024-05-08
Published