Is CVE-2026-40703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40703 being exploited in the wild.

How severe is CVE-2026-40703?

Medium severity, with a CVSS score of 5.4, published 13 May 2026.

Which products and versions are affected?

F5 BIG-IP 17.5.0 - 17.5.1, 16.1.0 - 16.1.6, Not specified (EoTS versions excluded).

Is there a fix for CVE-2026-40703?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40703 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40703?

Check whether you run F5 BIG-IP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40703: F5 BIG-IP CSRF in Configuration utility dashboard

CVE-2026-40703 · Severity: medium · CVSS 5.4 · Published 2026-05-13

A security vulnerability exists in the management dashboard of F5 BIG-IP networking devices. An attacker could trick an authenticated administrator into performing unintended actions on the device by clicking a malicious link. This could lead to unauthorized configuration changes or service disruptions on the network appliance.

Technologies: F5 BIG-IP. Vendors: F5.

Quick answers

Is CVE-2026-40703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40703 being exploited in the wild.
How severe is CVE-2026-40703?: Medium severity, with a CVSS score of 5.4, published 13 May 2026.
Which products and versions are affected?: F5 BIG-IP 17.5.0 - 17.5.1, 16.1.0 - 16.1.6, Not specified (EoTS versions excluded).
Is there a fix for CVE-2026-40703?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40703 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40703?: Check whether you run F5 BIG-IP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) exists in the F5 BIG-IP Configuration utility dashboard. The flaw allows a remote attacker to induce a victim (typically an administrator with an active session) to perform unintended actions via the web interface. The attack requires user interaction, specifically that the victim visits a malicious website or clicks a crafted link while authenticated to the BIG-IP management console. Successful exploitation can result in unauthorized configuration modifications or partial impact on system availability. F5 has released updates for affected versions, including 17.5.1.4 and later.

Affected products

F5 BIG-IP 17.5.0 - 17.5.1, 16.1.0 - 16.1.6

Timeline

2026-05-13: disclosed
2026-05-13: advisory

References

https://my.f5.com/manage/s/article/K35544022

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.