BIG-IP and BIG-IQ CVE-2026-40698

Requires pre-existing Resource Administrator role credentials on target BIG-IP or BIG-IQ system. Resource Administrator is a built-in highly privileged role in F5's RBAC model with permissions to manage system resources including SNMP configurations. Attacker must have network access to management interfaces (iControl REST API typically port 443/tcp, or SSH access for tmsh on port 22/tcp). Exploitation is NOT possible by unauthenticated attackers, low-privileged users, or standard application-layer traffic through the data plane. The vulnerability requires the SNMP configuration feature to be enabled and accessible to the Resource Administrator role, which is default behavior in supported BIG-IP/BIG-IQ deployments. Environments that have disabled Resource Administrator role entirely or removed SNMP configuration permissions from that role through custom RBAC policies are not exploitable through this vector.

While the CVSS base score of 8.7 reflects high confidentiality and integrity impact with network attack vector, the PR:H (high privileges required) metric is the critical limiting factor. Exploitation demands existing Resource Administrator access, which is a highly privileged role in F5 environments typically restricted to trusted operations staff. No EPSS score, KEV listing, or public exploit code was identified at time of analysis, suggesting this is not being actively exploited in the wild. Real-world risk is elevated primarily in environments with: (1) compromised Resource Administrator accounts, (2) insider threat scenarios, or (3) organizations with overly permissive RBAC policies granting Resource Administrator to non-security-vetted personnel. The scope change to confidentiality/integrity impact represents full device compromise capability. For most organizations, this is a medium-priority patch requiring standard change control rather than emergency deployment, unless Resource Administrator credentials are broadly distributed or recently compromised accounts are suspected.

An attacker who has compromised Resource Administrator credentials (through phishing, credential stuffing, or lateral movement from another system) authenticates to the BIG-IP management interface via iControl REST API or establishes a tmsh session. They craft a malicious SNMP configuration object containing embedded shell metacharacters or command injection payloads. Upon submission through the API or tmsh command, the improperly sanitized input executes with elevated system privileges, granting the attacker root-level access to the BIG-IP or BIG-IQ appliance and its managed configurations.