CVE-2026-40699: Configuration Utility Disclosure Flaw

CVE-2026-40699 Overview

CVE-2026-40699 is an information disclosure vulnerability affecting undisclosed pages in the F5 Configuration utility. A low-privileged authenticated attacker can access sensitive information that should remain restricted. The flaw is tracked under CWE-643, Improper Neutralization of Data within XPath Expressions.

The vulnerability is exploitable over the network with low attack complexity and requires only low privileges. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated. Full details are available in F5 Support Article K000156734.

Critical Impact
An authenticated low-privileged user can read sensitive configuration data through undisclosed pages in the Configuration utility, breaking the confidentiality boundary enforced by the management interface.

Affected Products

F5 Configuration utility (specific versions enumerated in F5 Support Article K000156734)
F5 BIG-IP product line containing the affected Configuration utility component
Software versions outside End of Technical Support scope as defined by F5

Discovery Timeline

2026-05-13 - CVE-2026-40699 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40699

Vulnerability Analysis

The vulnerability resides in undisclosed pages within the F5 Configuration utility, the web-based management interface used to administer F5 appliances. An attacker holding a valid low-privileged account can issue requests to these pages and retrieve sensitive information that should be restricted to higher-privileged roles.

The CWE-643 classification points to improper handling of data within XPath expressions. When user-controlled input is incorporated into an XPath query without adequate neutralization, the resulting query can return data outside the requester's intended authorization scope. The impact is restricted to confidentiality, with no integrity or availability consequences observed.

The attack vector is network-based and does not require user interaction, which simplifies exploitation against any accessible management interface.

Root Cause

The root cause is improper neutralization of attacker-controlled data used to construct XPath expressions within the Configuration utility. The application processes inputs without sanitizing characters that influence XPath query semantics. As a result, the underlying query returns nodes the requesting user is not authorized to view.

Attack Vector

An attacker first obtains low-privileged credentials to the Configuration utility, then sends crafted HTTP requests to the affected undisclosed pages. The server processes the request and returns sensitive data from the XML data store. No phishing, social engineering, or client-side execution is needed.

No public proof-of-concept code is currently available. Refer to F5 Support Article K000156734 for vendor-supplied technical context.

Detection Methods for CVE-2026-40699

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts to administrative or undocumented paths within the Configuration utility
Requests containing XPath metacharacters such as single quotes, or, and, [, ], or // in query parameters
Successful responses with large payloads to accounts that normally retrieve minimal data
Authentication sessions originating from non-administrative network segments accessing management endpoints

Detection Strategies

Inspect Configuration utility access logs for low-privileged users accessing pages outside their normal role profile
Correlate authentication events with subsequent high-volume data retrieval requests from the same session
Alert on HTTP request parameters containing XPath injection patterns targeting the management interface
Baseline normal request patterns per role and flag deviations to undisclosed or rarely-used endpoints

Monitoring Recommendations

Forward Configuration utility HTTP and authentication logs to a centralized analytics platform for correlation
Track per-user request frequency and response size to identify reconnaissance behavior
Restrict management plane traffic to dedicated subnets and monitor any lateral attempts to reach it
Review F5 audit logs for changes in account privilege levels and creation of new low-privilege accounts

How to Mitigate CVE-2026-40699

Immediate Actions Required

Apply the fixed software versions identified in F5 Support Article K000156734 as soon as they are validated for your environment
Restrict network access to the Configuration utility to trusted administrative networks only
Audit existing accounts and remove any low-privileged users that no longer require management access
Rotate credentials for accounts that may have been used to access the affected pages prior to patching

Patch Information

F5 has published remediation guidance and fixed version information in F5 Support Article K000156734. Software branches that have reached End of Technical Support are not evaluated and should be upgraded to a supported, patched release.

Workarounds

Limit Configuration utility access to a management-only VLAN protected by ACLs and jump hosts
Disable or remove unused low-privilege accounts and enforce strong authentication for remaining accounts
Place a reverse proxy or WAF in front of the management interface to filter requests containing XPath injection patterns
Enable multi-factor authentication on all management accounts to raise the cost of credential abuse

bash

# Example: restrict Configuration utility access to a management subnet on BIG-IP
# Replace 10.10.0.0/24 with your administrative network range
tmsh modify sys httpd allow replace-all-with { 10.10.0.0/24 }
tmsh save sys config