F5 BIG-IP CVE-2026-40703

Exploitation requires three specific conditions: (1) The target must be running a BIG-IP version that has not reached End of Technical Support (EoTS versions explicitly out of scope per CVE description); (2) The authenticated user (BIG-IP administrator) must have an active session to the Configuration utility dashboard in their browser; (3) The user must be induced to visit or be redirected to an attacker-controlled webpage while that session is active. No special BIG-IP configuration is required-the vulnerability exists in the default dashboard functionality. Exploitation is limited by the requirement for user interaction (UI:R in CVSS vector) and by the scope being restricted to the authenticated user's session context (S:U), meaning cross-account privilege escalation is not possible.

CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) indicates network-accessible CSRF with low attack complexity but requiring user interaction (UI:R). The integrity and availability impacts are limited in scope but measurable. Real-world risk is MODERATE: while CVSS is below critical thresholds, CSRF vulnerabilities targeting administrative dashboards pose significant operational risk in production environments where BIG-IP administrators routinely access the web interface. The requirement for user interaction (clicking a malicious link) reduces opportunistic exploitation but does not eliminate risk in targeted scenarios (phishing, watering-hole attacks). No EPSS score, KEV listing, or public POC identified, suggesting this is not yet widely exploited. Risk is concentrated among organizations running non-end-of-support BIG-IP versions and accepting connections from untrusted networks to the administrative dashboard.

An attacker crafts a malicious webpage (or embeds malicious content on a legitimate site via advertisement or compromise) that contains hidden requests to modify BIG-IP configuration-for example, disabling security policies or changing administrative settings. The attacker sends a phishing email to BIG-IP administrators with a link to this page. When an authenticated administrator clicks the link while logged into the BIG-IP dashboard in another browser tab, the hidden request executes in the context of their authenticated session, modifying the BIG-IP configuration without their knowledge.