CVE-2026-40631: F5 BIG-IP privilege escalation in iControl SOAP

CVE-2026-40631 · Severity: high · CVSS 8.7 · Published 2026-05-13

F5 BIG-IP is a suite of networking and security solutions used to manage application traffic and protect corporate networks. A vulnerability in the management interface allows an authorized administrator with restricted permissions to bypass security controls and modify system configuration objects. This could lead to a full takeover of the device, potentially allowing an attacker to intercept traffic or disrupt critical business services.

Technologies: F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager. Vendors: F5.

Quick answers

Is CVE-2026-40631 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40631 being exploited in the wild.
How severe is CVE-2026-40631?
High severity, with a CVSS score of 8.7, published 13 May 2026.
Which products and versions are affected?
F5 BIG-IP All versions prior to EoTS evaluation; F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0; and 1 more.
Is there a fix for CVE-2026-40631?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40631 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40631?
Check whether you run F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 Big-Ip Access Policy Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in F5 BIG-IP's iControl SOAP interface. The flaw allows authenticated users with high-level but restricted roles, such as Resource Administrator, to modify configuration objects they should not have access to. By manipulating these objects, an attacker can escalate their privileges to gain broader control over the system. The attack is reachable over the network via the management interface, though it requires valid administrative credentials. F5 has released security updates to address this issue in supported versions.

Affected products

  • F5 BIG-IP Access Policy Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Advanced Firewall Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Advanced WAF 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0
  • F5 BIG-IP Local Traffic Manager 16.1.0-16.1.6, 17.5.0-17.5.1, 21.0.0

Timeline

  • 2026-05-13: advisory: Initial publication of the vulnerability advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.