F5 BIG-IP CVE-2026-40631

Requires valid Resource Administrator or Administrator role credentials for F5 BIG-IP management interface. Exploitation specifically targets systems where iControl SOAP API is enabled and accessible to Resource Administrator accounts. Network access to BIG-IP management interface (typically TCP port 443 for HTTPS management or dedicated management network) is required - the remote attack vector (AV:N) allows exploitation from any network location once authenticated. No user interaction needed (UI:N) and low attack complexity (AC:L) once credentials are obtained. Limiting factor: the attacker must first possess or obtain high-privilege Resource Administrator credentials, which typically requires prior account compromise, insider access, or credential theft. Organizations not delegating Resource Administrator role or those restricting management interface access to isolated administrative networks face lower practical risk despite the vulnerability's presence.

Real-world risk is moderate despite the 8.7 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C) indicates network-exploitable with low complexity, but critically requires high privileges (PR:H) - the attacker must already possess valid Resource Administrator credentials. Changed scope (S:C) reflects privilege boundary violation. No CISA KEV listing indicates no confirmed widespread exploitation. No public exploit code identified at time of analysis. The attack is not automatable against internet-facing systems due to the authentication prerequisite. Primary risk scenarios include malicious insiders with Resource Administrator access, or attackers who have already compromised Resource Administrator accounts through credential theft or social engineering. Organizations with strict separation of duties between Resource Administrators and full Administrators face elevated risk, as this vulnerability undermines that security control. The network attack vector means exploitation can occur remotely once credentials are obtained, not requiring console access.

An attacker who has compromised Resource Administrator credentials (through phishing, credential stuffing, or insider threat) authenticates to the BIG-IP management interface remotely. They craft malicious iControl SOAP requests targeting configuration objects that should be restricted to full Administrators, such as user account management or global system settings. By exploiting the insufficient permission validation, they modify these objects to create a new Administrator account or elevate their existing Resource Administrator account to full Administrator privileges, gaining unrestricted access to all BIG-IP configuration, virtual server policies, SSL certificates, and sensitive traffic management rules across the entire device scope.