CVE-2026-66247 in iControl
Summary
by MITRE • 10/01/2026
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The iControl REST API interface suffers from a misconfigured Cross-Origin Resource Sharing (CORS) policy that fails to properly restrict which origins are permitted to make cross-origin requests containing credentials such as cookies, HTTP authentication headers, or client-side SSL certificates. This vulnerability arises because the server configuration allows wildcard origin access for sensitive endpoints without adequate validation of the requesting context. In a standard web security model, browsers enforce same-origin policies to prevent malicious sites from reading data sent by other applications. However, when CORS is misconfigured with permissive settings like Access-Control-Allow-Origin set to an asterisk or specific untrusted domains combined with Allow-Credentials enabled, it effectively disables these browser-side protections for authenticated sessions.
An attacker can exploit this flaw by hosting a malicious webpage that contains JavaScript code designed to send HTTP requests to the iControl REST API endpoint while including the victim's session cookies in those requests due to the credentials flag being honored despite the cross-origin nature of the request. Since the server accepts these requests and returns the data, the browser allows the malicious script to read the response body. This enables a remote attacker to perform actions on behalf of an authenticated user without their knowledge or consent, effectively bypassing authentication controls through social engineering tactics such as phishing links that direct victims to the crafted payload while they are logged into the management interface.
The operational impact of this vulnerability is severe, particularly in environments where iControl REST API provides administrative access to network devices like F5 BIG-IP systems. Successful exploitation allows an attacker to exfiltrate sensitive configuration data, including network topology details, security policies, and potentially credentials stored within device configurations. Furthermore, the ability to execute cross-origin requests with included credentials means that attackers can modify system settings, disable security controls, or pivot further into internal networks by leveraging the compromised administrative session. This represents a critical risk to confidentiality and integrity of managed infrastructure components relying on this API for automation and management tasks.
This vulnerability aligns with CWE-942 which describes Permissive Cross-Origin Resource Sharing (CORS) misconfiguration allowing credential inclusion, as well as OWASP A05:2021 Security Misconfiguration where default or overly permissive settings are left in place without hardening. From an ATT&CK perspective, this technique falls under T1534 which covers Internal Spearphishing and specifically relates to the use of browser-based techniques for data exfiltration via web application vulnerabilities. To mitigate this risk, administrators should restrict the Access-Control-Allow-Origin header to only include explicitly trusted domains rather than using wildcards or allowing all origins when credentials are involved. Additionally implementing strict Content-Security-Policy headers and ensuring that sensitive API endpoints do not support cross-origin requests unless absolutely necessary for legitimate business functions will significantly reduce the attack surface. Regular security audits of web server configurations against industry standards such as CIS Benchmarks can help identify and correct these misconfigurations before they are exploited in the wild.