CVE-2026-40699: F5 BIG-IP XPath injection in Configuration utility

CVE-2026-40699 · Severity: medium · CVSS 6.5 · Published 2026-05-13

A vulnerability in the F5 BIG-IP Configuration utility could allow a user with low-level access to view sensitive system information they are not authorized to see. This utility is used by administrators to manage network traffic and security settings. An exploit could lead to the exposure of internal configuration details, potentially aiding further attacks against the organization's network infrastructure.

Technologies: F5 BIG-IP, F5 BIG-IP DNS, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager. Vendors: F5.

Quick answers

Is CVE-2026-40699 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40699 being exploited in the wild.
How severe is CVE-2026-40699?
Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?
F5 BIG-IP Not specified (EoTS versions excluded); F5 BIG-IP DNS 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; and 2 more.
Is there a fix for CVE-2026-40699?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40699 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40699?
Check whether you run F5 BIG-IP, F5 BIG-IP DNS, F5 Big-Ip Access Policy Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An XPath injection vulnerability (CWE-643) exists within undisclosed pages of the F5 BIG-IP Configuration utility. The flaw is caused by improper neutralization of data within XPath expressions, which can be triggered by an authenticated attacker with low-level privileges. By sending specially crafted requests over the network to the management interface, an attacker can bypass intended access controls to retrieve sensitive configuration data. The vulnerability affects multiple BIG-IP modules including LTM, APM, AFM, and DNS across versions 16.1.x and 17.5.x. F5 has provided mitigation guidance in advisory K000156734.

Affected products

  • F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
  • F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
  • F5 BIG-IP Advanced Web Application Firewall 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
  • F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
  • F5 BIG-IP DNS 16.1.0 - 16.1.6, 17.5.0 - 17.5.1

Timeline

  • 2026-05-13: advisory: Initial publication of the vulnerability details.
  • 2026-06-24: other: NVD last modified date.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.