Loading vulnerability…
CVE-2024-26026 is an SQL injection vulnerability in the API of F5 BIG-IP Next Central Manager. The flaw is caused by insufficient validation of user-supplied input in API URI handling, allowing malicious SQL statements to be injected and executed against the backend database. The issue affects BIG-IP Next Central Manager 20.x releases prior to 20.2.0, including versions 20.0.1 through 20.1.0. The vulnerability is remotely exploitable and does not require authentication. Successful exploitation can expose sensitive data, enable authentication bypass, and can lead to full administrative compromise of the affected system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept exploit for CVE-2024-26026, targeting the F5 BIG-IP Next Central Manager API. The exploit is implemented in a single Python script (poc.py) and is designed to perform a blind SQL injection attack against the /api/login endpoint. By sending specially crafted POST requests with a manipulated 'provider_name' field, the script is able to enumerate and leak the password hash of a specified user (default: admin) from the backend database. The script iteratively guesses each character of the hash by observing the application's error messages. The repository also includes a brief README describing the vulnerability. No hardcoded IPs or domains are present; the target URL is provided as a command-line argument. The exploit is a functional POC and does not include weaponized or post-exploitation payloads.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical vulnerability in F5 BIG-IP Next Central Manager caused by insufficient input validation, allowing an unauthenticated remote attacker to perform SQL injection, access sensitive data, bypass authentication, and potentially take full control of the system.
An unauthenticated SQL injection vulnerability in F5 BIG-IP Next Central Manager API that can enable execution of malicious SQL statements and contribute to full administrative compromise of the device.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.