CVE-2026-40631 Overview
CVE-2026-40631 is a privilege escalation vulnerability affecting F5 BIG-IP systems exposing the iControl SOAP interface. An authenticated attacker holding the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP to gain elevated privileges beyond their assigned role. The flaw is tracked under CWE-552: Files or Directories Accessible to External Parties.
F5 published guidance for this issue in F5 Security Article K000160979. Software versions that have reached End of Technical Support (EoTS) were not evaluated and remain out of scope for the vendor advisory.
Critical Impact
An authenticated administrator can pivot from a restricted administrative role to full system control, undermining role-based access boundaries on BIG-IP appliances.
Affected Products
- F5 BIG-IP systems exposing the iControl SOAP interface
- Accounts assigned the Resource Administrator role
- Accounts assigned the Administrator role
Discovery Timeline
- 2026-05-13 - CVE-2026-40631 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-40631
Vulnerability Analysis
The vulnerability resides in F5's iControl SOAP management interface. iControl SOAP is the legacy programmatic API used to configure and operate BIG-IP devices. The interface accepts authenticated SOAP requests that read and modify configuration objects on the appliance.
The issue allows an authenticated user assigned the Resource Administrator or Administrator role to alter configuration objects in ways that grant additional privileges. Role separation on BIG-IP exists specifically to limit the blast radius of administrative compromise. This flaw breaks that boundary by allowing in-scope users to escalate beyond their assigned permissions.
The weakness is classified as CWE-552, indicating that configuration files or directories are reachable through the SOAP surface in a way that exceeds the intended access model.
Root Cause
The root cause is insufficient authorization enforcement on configuration objects exposed through iControl SOAP. Although authentication is required, the API does not consistently validate that the caller's role permits the requested configuration change. As a result, a lower-tier administrator can write to objects reserved for higher-privileged contexts.
Attack Vector
Exploitation requires network access to the iControl SOAP endpoint and valid credentials with either the Resource Administrator or Administrator role. The attacker issues SOAP requests against configuration management methods and modifies objects that influence privilege boundaries. No user interaction is required, and the attack proceeds over the network against the management interface.
No verified public proof-of-concept is available. Refer to F5 Security Article K000160979 for vendor-supplied technical detail.
Detection Methods for CVE-2026-40631
Indicators of Compromise
- SOAP requests to iControl endpoints from administrator accounts that modify configuration objects outside their normal operational patterns.
- Unexpected changes to user, role, or partition configuration objects on BIG-IP devices.
- New or modified administrative accounts created shortly after iControl SOAP activity from a Resource Administrator session.
Detection Strategies
- Enable and centralize BIG-IP audit logging, then alert on configuration changes initiated via iControl SOAP rather than the standard UI workflow.
- Correlate authentication events for Resource Administrator accounts with subsequent privileged configuration writes.
- Baseline normal iControl SOAP method usage per account and flag deviations involving role or user object manipulation.
Monitoring Recommendations
- Forward BIG-IP /var/log/audit and /var/log/restjavad-audit.0.log to a centralized logging platform for retention and search.
- Monitor administrative session activity on the BIG-IP management plane for anomalous SOAP request volumes or targets.
- Track changes to high-value configuration objects, including authentication, user, and partition definitions.
How to Mitigate CVE-2026-40631
Immediate Actions Required
- Review the vendor advisory at F5 Security Article K000160979 and apply the listed fixed software versions for your branch.
- Audit all accounts assigned the Resource Administrator or Administrator role and remove unnecessary privileges.
- Restrict management plane network access to a dedicated administrative network or jump-host subnet.
- Rotate credentials for administrative accounts that may have been exposed, including any service accounts using iControl SOAP.
Patch Information
F5 provides fixed versions and detailed remediation guidance in F5 Security Article K000160979. Software versions that have reached End of Technical Support are not evaluated; operators on those branches should upgrade to a supported release. Apply patches following standard BIG-IP change management procedures and validate configuration integrity post-upgrade.
Workarounds
- Limit access to the iControl SOAP interface to trusted management hosts using packet filters or the BIG-IP Port Lockdown settings on the self IP.
- Disable iControl SOAP where it is not required for automation and rely on iControl REST with tighter authorization controls.
- Enforce least-privilege role assignments and avoid granting Resource Administrator or Administrator roles to users or automation accounts that do not require them.
# Example: restrict management access via tmsh on BIG-IP
tmsh modify sys httpd allow replace-all-with { <trusted_mgmt_cidr> }
tmsh modify net self <self_ip> allow-service none
tmsh save sys config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
