Which versions of BIG-IP and BIG-IQ are affected by CVE-2026-40698?

CVE-2026-40698 affects F5 BIG-IP and BIG-IQ systems and enables privilege escalation from Resource Administrator to root through SNMP configuration manipulation, creating insider threat and…. A patch is available.

How to fix or mitigate CVE-2026-40698?

Within 24 hours: Identify all F5 BIG-IP and BIG-IQ systems in your environment and confirm current versions against F5 security advisory K000160981. Within 7 days: Apply vendor-released patches per advisory K000160981 to all affected systems, prioritizing production instances. Within 30 days: Verify patch application across all systems, review and restrict Resource Administrator role assignments to minimize credential exposure, and implement audit logging of administrative SNMP configuration changes.

BIG-IP and BIG-IQ CVE-2026-40698

Q: What is the CVSS score of CVE-2026-40698?

CVE-2026-40698 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29979 HIGH

Command Injection (CWE-77)

2026-05-13 f5

GHSA-r6m3-x9hj-j6gx

Privilege Escalation Command Injection Big Ip Big Iq

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:48 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Command injection in F5 BIG-IP and BIG-IQ SNMP configuration allows highly privileged Resource Administrators to escalate privileges to root via crafted iControl REST API calls or TMOS shell commands. Despite the high CVSS score (8.7), exploitation requires existing Resource Administrator credentials, significantly limiting real-world attack surface to insider threats or post-compromise scenarios. Vendor-released patches are available per F5 security advisory K000160981.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements in SNMP configuration object creation (CWE-77: Command Injection). F5's BIG-IP Application Delivery Controllers and BIG-IQ centralized management platform use the Traffic Management Operating System (TMOS) and expose management interfaces through iControl REST API and the tmsh command-line shell. The SNMP configuration subsystem fails to properly sanitize input when Resource Administrators create SNMP objects, allowing injection of operating system commands. The scope change (S:C) in the CVSS vector indicates the vulnerability can impact resources beyond the vulnerable component's security scope, consistent with privilege escalation from Resource Administrator to full system access.

RemediationAI

Apply vendor-released security patches documented in F5 Security Advisory K000160981 available at https://my.f5.com/manage/s/article/K000160981. Follow F5's standard upgrade procedures for BIG-IP and BIG-IQ systems, ensuring configuration backups are current before patching. If immediate patching is not feasible, implement compensating controls: (1) Audit and minimize accounts with Resource Administrator role to only essential personnel with verified need-to-know, (2) Enable enhanced logging for iControl REST API calls and tmsh command execution by Resource Administrators to detect suspicious SNMP configuration changes, (3) Implement additional approval workflows requiring Security Administrator review before Resource Administrators can create or modify SNMP objects (achievable through custom iControl LX extensions or workflow automation). Note that restricting SNMP functionality entirely may impact legitimate monitoring and management operations. These compensating controls reduce attack surface but do not eliminate the vulnerability.