CVE-2026-41954CWE-200

iControl REST and tmsh vulnerability

Medium · published May 13, 2026

CVSS v4.0

6.9

EPSS

Percentile

33.5

In the wild

Unconfirmed

What it is

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record

Technical detail

CVSS v4.0: 6.9 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00404 · 33.5th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-05-13T14:12Z

EPSS history

Timeline

13 MAY 14:12Z
iControl REST and tmsh vulnerability
cvelistv5