Is there a patch available for CVE-2026-40699?

Yes, a patch is available for CVE-2026-40699. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-40699

Q: What is the CVSS score of CVE-2026-40699?

CVE-2026-40699 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29980 HIGH

Improper Neutralization of Data within XPath Expressions ('XPath Injection') (CWE-643)

2026-05-13 f5

GHSA-429c-h8f6-fcq6

Information Disclosure Big Ip

7.1

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 13, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 13, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

May 13, 2026 - 15:52 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 6.5

DescriptionCVE.org

A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Information disclosure in F5 BIG-IP Configuration utility allows low-privileged authenticated attackers to access sensitive information through undisclosed pages, affecting the confidentiality of administrative data without requiring user interaction or privileged credentials beyond standard authentication.

Technical ContextAI

The vulnerability resides in the Configuration utility component of F5 BIG-IP, a widely-deployed application delivery controller and load balancer platform. The root cause (CWE-643: Improper Neutralization of Data into an XPath Expression) suggests the vulnerability involves unsafe handling of user input in XPath queries or similar data access mechanisms that fail to properly validate or sanitize parameters before querying configuration data stores. The affected versions span BIG-IP deployments across its entire product line (CPE: cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*), though organizations running end-of-life versions (EoTS) are explicitly excluded from vendor support assessment.

RemediationAI

Apply the vendor-released patch available via F5 support article K000150515 at https://my.f5.com/manage/s/article/K000150515. Organizations unable to patch immediately should restrict network access to the Configuration utility management interface using firewall rules or management IP whitelisting, limiting exposure to trusted administrative subnets only. Additionally, enforce the principle of least privilege by auditing BIG-IP user accounts and removing low-privilege authentication credentials that do not require Configuration utility access, reducing the attack surface for credential compromise. Note that network isolation is a temporary control with reduced usability impact but does not address the root vulnerability-patching remains the required long-term remediation.