CVE-2026-40631: Privilege Escalation in F5 BIG-IP

Successful exploitation of CVE-2026-40631 allows an attacker with administrative privileges to escalate their access within the F5 BIG-IP system. This could involve modifying critical configuration settings, creating backdoors, or gaining full control over the device. The impact extends beyond the BIG-IP appliance itself, as it could be leveraged to compromise other systems within the network if the BIG-IP is used for traffic management or as a gateway. A compromised BIG-IP could be used to intercept and modify traffic, steal sensitive data, or launch attacks against internal resources, significantly expanding the blast radius.

1. Reserviert2026-04-30
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-40631 is to upgrade F5 BIG-IP to version 21.0.0.2 or later. If immediate upgrade is not possible due to compatibility concerns or testing requirements, consider implementing stricter access controls within iControl SOAP. Restrict access to the SOAP interface to only authorized users and implement multi-factor authentication where feasible. Monitor iControl SOAP logs for suspicious activity, particularly attempts to modify configuration objects. While not a direct fix, implementing a Web Application Firewall (WAF) with rules to detect and block malicious SOAP requests can provide an additional layer of defense. After upgrading, verify the fix by attempting to modify a configuration object via iControl SOAP with a lower-privileged account; the operation should be denied.