CVE-2026-40631: Privilege Escalation in F5 BIG-IP
Platform
bigip
Component
bigip
Fixed in
21.0.0.2
CVE-2026-40631 describes a privilege escalation vulnerability in F5 BIG-IP. An authenticated administrator with the Resource Administrator or Administrator role can exploit this flaw to modify configuration objects through the iControl SOAP interface, leading to unauthorized privilege elevation. This vulnerability impacts versions 16.1.0 through 21.0.0.2. A fix is available in version 21.0.0.2.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-40631 allows an attacker to gain elevated privileges within the F5 BIG-IP system. This could enable them to modify critical configurations, bypass security controls, and potentially gain complete control of the device. The attacker would need to be authenticated with either the Resource Administrator or Administrator role to exploit this vulnerability. The blast radius extends to any data or services managed by the BIG-IP, including web applications, load balancing configurations, and security policies. Compromise could lead to data breaches, denial of service, or further lateral movement within the network.
Exploitation Context
CVE-2026-40631 is currently not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is pending evaluation. Public proof-of-concept (POC) code is not currently available. The vulnerability was published on 2026-05-13. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-40631 is to upgrade to F5 BIG-IP version 21.0.0.2 or later. If immediate upgrade is not possible, consider implementing stricter access controls to limit the number of users with Resource Administrator or Administrator privileges. Review iControl SOAP access and consider restricting it to only necessary users and systems. Implement Web Application Firewall (WAF) rules to detect and block suspicious iControl SOAP requests. Monitor iControl SOAP logs for unusual activity, specifically looking for configuration modification attempts from unauthorized sources. After upgrade, confirm the fix by attempting to modify a configuration object via iControl SOAP with a lower-privileged account; the modification should be denied.
How to fix
Aplique las actualizaciones de seguridad proporcionadas por F5 para BIG-IP. Consulte la nota de seguridad K000160979 en el sitio web de F5 para obtener más detalles sobre las versiones corregidas y el proceso de actualización.
Frequently asked questions
What is CVE-2026-40631 — Privilege Escalation in F5 BIG-IP?
CVE-2026-40631 is a HIGH severity vulnerability allowing authenticated administrators to escalate privileges within F5 BIG-IP via iControl SOAP configuration manipulation, potentially granting unauthorized access.
Am I affected by CVE-2026-40631 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.2. Check your version and upgrade accordingly.
How do I fix CVE-2026-40631 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.2 or later. As a temporary workaround, restrict iControl SOAP access and tighten user privileges.
Is CVE-2026-40631 being actively exploited?
There are currently no public reports of active exploitation, but monitoring for activity is recommended.
Where can I find the official F5 advisory for CVE-2026-40631?
Refer to the official F5 Security Advisory for CVE-2026-40631 on the F5 website (check F5's security portal for the latest advisory).
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...