PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40631 F5 CVE debrief

CVE-2026-40631 is a HIGH severity vulnerability in F5 BIG-IP products. An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP, resulting in privilege escalation. This issue affects multiple F5 BIG-IP products across various versions. Software versions that have reached End of Technical Support (EoTS) are not evaluated. F5 has provided mitigation guidance.

Vendor
F5
Product
BIG-IP
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-29
Advisory published
2026-05-13
Advisory updated
2026-06-29

Who should care

Organizations using F5 BIG-IP products, especially those with versions 16.1.0 through 17.1.3 and 17.5.0 through 17.5.1, should be concerned. Administrators with Resource Administrator or Administrator roles are at risk. Immediate attention is required to apply mitigations or patches.

Technical summary

The vulnerability exists in the iControl SOAP interface of F5 BIG-IP products. An authenticated attacker with specific roles can exploit this by modifying configuration objects, leading to privilege escalation. Affected products include BIG-IP Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, and many others across different versions. The CVSS score is 8.5, indicating a HIGH severity level.

Defensive priority

High. Apply vendor patches or mitigations immediately. Restrict access to iControl SOAP for sensitive roles.

Recommended defensive actions

  • Apply F5 patches for affected BIG-IP versions.
  • Implement compensating controls to restrict iControl SOAP access.
  • Monitor for suspicious iControl SOAP activity.
  • Inventory BIG-IP products for vulnerability.
  • Follow F5's mitigation guidance (K000160979).
  • Consider upgrading to non-vulnerable versions.

Evidence notes

CVE-2026-40631 is confirmed by F5 and NVD. Multiple CPEs are listed as vulnerable. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40631 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40631

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40631 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40631

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.