Is CVE-2026-40698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40698 being exploited in the wild.

How severe is CVE-2026-40698?

High severity, with a CVSS score of 8.7, published 13 May 2026.

Which products and versions are affected?

F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IQ All versions.

Is there a fix for CVE-2026-40698?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40698 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40698?

Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40698: F5 BIG-IP and BIG-IQ privilege escalation in SNMP configuration

CVE-2026-40698 · Severity: high · CVSS 8.7 · Published 2026-05-13

F5 BIG-IP and BIG-IQ systems, which are used to manage and secure enterprise network traffic, are affected by a privilege escalation vulnerability. An authorized user with administrative rights can manipulate system configuration settings to gain even higher levels of control over the device. This could allow an internal attacker to bypass security restrictions, potentially leading to full system compromise and unauthorized access to sensitive network data.

Technologies: F5 BIG-IP, F5 BIG-IQ. Vendors: F5.

Quick answers

Is CVE-2026-40698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40698 being exploited in the wild.
How severe is CVE-2026-40698?: High severity, with a CVSS score of 8.7, published 13 May 2026.
Which products and versions are affected?: F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IQ All versions.
Is there a fix for CVE-2026-40698?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40698 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40698?: Check whether you run F5 BIG-IP or F5 BIG-IQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in F5 BIG-IP and BIG-IQ systems due to improper neutralization of special elements used in a command (command injection) within SNMP configuration object creation. An authenticated attacker with at least the Resource Administrator role can exploit this via the iControl REST interface or the TMOS shell (tmsh). By creating specifically crafted SNMP configuration objects, the attacker can execute commands with elevated privileges, potentially gaining full control of the underlying system. The vulnerability is tracked as CVE-2026-40698 and has been assigned a CVSS score of 8.7. F5 has released security advisories and patches for affected versions, though software that has reached End of Technical Support was not evaluated.

Affected products

F5 BIG-IP 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IQ All versions

Timeline

2026-05-13: advisory: Initial publication of the vulnerability advisory

References

https://my.f5.com/manage/s/article/K000160981

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.