Is there a patch available for CVE-2026-40703?

Yes, a patch is available for CVE-2026-40703. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-40703

Q: What is the CVSS score of CVE-2026-40703?

CVE-2026-40703 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29982 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-13 f5

GHSA-wx9p-7qp3-h2rx

CSRF Big Ip

5.3

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:45 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 5.4

DescriptionCVE.org

A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Cross-site request forgery (CSRF) in F5 BIG-IP Configuration utility dashboard allows unauthenticated remote attackers to perform unauthorized actions (integrity and availability impact) against authenticated users through malicious web pages, requiring user interaction to click a crafted link. Patch is available from F5. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

F5 BIG-IP is a network application delivery and security platform. The vulnerable component is the Configuration utility dashboard, which provides administrative interface for BIG-IP system management. The CSRF vulnerability (CWE-352) arises from insufficient anti-CSRF token validation or absence of same-site cookie protections in the dashboard's state-changing operations. An attacker can craft a malicious webpage or email that, when visited by an authenticated BIG-IP administrator, triggers unintended administrative actions on the BIG-IP system without the user's knowledge or consent. The attack exploits the browser's automatic inclusion of session credentials in cross-origin requests.

RemediationAI

Apply the vendor-released patch from F5 advisory K35544022 (https://my.f5.com/manage/s/article/K35544022). This advisory contains the patched BIG-IP version(s) and installation instructions. Until patch deployment is feasible, implement compensating controls: (1) Restrict network access to the BIG-IP Configuration utility dashboard to trusted administrative networks only using firewall rules or network segmentation-this significantly reduces the attack surface by limiting who can serve malicious pages to administrators; (2) Disable or restrict access to the dashboard's web interface if command-line or API administration is available as an alternative; (3) Train administrators to avoid clicking external links while authenticated to BIG-IP, as the attack requires user interaction to succeed. Each control has trade-offs: network restriction may impact remote administration workflows; disabling the web interface may force operational changes; user training is labor-intensive and subject to human error.