Is there a patch available for CVE-2026-40435?

Yes, a patch is available for CVE-2026-40435. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-40435

Q: What is the CVSS score of CVE-2026-40435?

CVE-2026-40435 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29973 MEDIUM

Unprotected Alternate Channel (CWE-420)

2026-05-13 f5

GHSA-8463-7qgv-32mg

Information Disclosure Big Ip

6.9

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:51 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 5.3

DescriptionCVE.org

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

IP-based access control restrictions in F5 BIG-IP httpd do not uniformly apply to all endpoints, allowing unauthenticated remote attackers from blocked IP addresses to access protected resources and disclose sensitive information. The vulnerability affects default configurations where network-based access policies are expected to enforce restrictions across the entire application stack, but certain endpoints bypass these controls. A vendor patch is available.

Technical ContextAI

F5 BIG-IP uses httpd to serve administrative and application endpoints. IP-based access restrictions (a form of network-layer access control) are typically configured at the web server or reverse proxy level to enforce allow/deny policies by source IP address. This vulnerability stems from incomplete coverage of access control logic (CWE-420: Uninitialized Variable), meaning the httpd configuration or routing logic fails to apply IP restrictions consistently to all URI endpoints or request types. The CVE affects BIG-IP across unspecified version ranges, indicating the flaw may exist in multiple major versions currently still receiving technical support.

RemediationAI

Apply the vendor-released patch from F5 available at https://my.f5.com/manage/s/article/K000156604. The patch corrects the httpd configuration or routing logic to uniformly enforce IP-based access restrictions across all endpoints. If patching cannot be immediately deployed, implement compensating controls by placing BIG-IP behind a network firewall or WAF that enforces IP-based restrictions at a layer above httpd (network perimeter control), reducing reliance on httpd's incomplete filters. However, this adds latency and administrative complexity. Alternatively, restrict network access to BIG-IP management interfaces via firewall rules at the network boundary, limiting exposure to blocked addresses. Note: These workarounds do not protect application endpoints served by BIG-IP if they are exposed to the affected addresses; therefore, patching is the definitive remediation.