PT-2026-40654 · F5 · Big-Ip

Published 2026-05-13 · Updated 2026-05-17 · CVE-2026-40699

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.1 F5 BIG-IP versions prior to 17.5.1.4 F5 BIG-IP versions prior to 21.0.0.1

Description An xpath injection issue exists in undisclosed pages of the Configuration utility. This allows a low-privileged authenticated attacker to access undisclosed sensitive information. XPath injection is a technique where an attacker inserts malicious expressions into an XML query to manipulate the data returned by the application.

Recommendations Update to version 17.1.3.1 or later. Update to version 17.5.1.4 or later. Update to version 21.0.0.1 or later.

Fix

Weakness Enumeration

CWE-643

Related Identifiers

CVE-2026-40699

Affected Products

Big-Ip

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40699 · Security Note
• https://my.f5.com/manage/s/article/K000150515 · Patch, Vendor Advisory
• https://twitter.com/f1tym1/status/2055991613222953403 · Twitter Post
• https://my.f5.com/manage/s/article/K000156734 · Patch, Vendor Advisory