CVE-2026-40703 Overview
CVE-2026-40703 is a Cross-Site Request Forgery (CSRF) vulnerability in the dashboard of the F5 BIG-IP Configuration utility. The flaw is tracked under CWE-352 and affects supported BIG-IP releases. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5. An attacker can craft a malicious request that, when triggered by an authenticated administrator, performs unintended state-changing actions in the Configuration utility. Exploitation requires user interaction but no prior authentication of the attacker.
Critical Impact
An attacker can leverage an authenticated administrator's browser session to perform unauthorized actions in the BIG-IP Configuration utility dashboard, affecting integrity and availability.
Affected Products
- F5 BIG-IP Configuration utility (dashboard component)
- Refer to F5 Security Advisory K35544022 for the specific supported version ranges
- Versions at End of Technical Support (EoTS) were not evaluated
Discovery Timeline
- 2026-05-13 - CVE-2026-40703 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-40703
Vulnerability Analysis
The BIG-IP Configuration utility is the web-based administrative interface used to manage F5 BIG-IP appliances. The dashboard component does not adequately validate the origin or intent of state-changing HTTP requests. An attacker who lures an authenticated administrator to a malicious page can cause the browser to issue requests to the Configuration utility using the administrator's existing session.
The vulnerability is classified under [CWE-352] Cross-Site Request Forgery. The EPSS probability of exploitation is 0.027% (percentile 7.74) as of 2026-05-17, indicating low observed exploitation likelihood. No public proof-of-concept code or active exploitation has been reported.
Root Cause
The root cause is missing or insufficient anti-CSRF protections on dashboard endpoints. Typical safeguards such as unpredictable per-session CSRF tokens, strict SameSite cookie attributes, or Origin/Referer header validation are not consistently enforced for the affected requests. The server therefore accepts cross-origin requests that carry valid session cookies as if they were issued intentionally by the administrator.
Attack Vector
The attack vector is network-based and requires user interaction (UI:P). An attacker hosts a malicious web page or sends a crafted link to an administrator who is currently authenticated to the BIG-IP Configuration utility. When the administrator visits the page, the browser silently issues forged requests to the dashboard. The forged requests inherit the administrator's session, allowing limited integrity and availability impact on the appliance configuration. The vulnerability does not expose confidential data directly (VC:N), but can modify state (VI:L) and affect availability (VA:L).
No verified exploit code is publicly available. Refer to the F5 Security Advisory K35544022 for vendor-supplied technical details.
Detection Methods for CVE-2026-40703
Indicators of Compromise
- Unexpected configuration changes in the BIG-IP Configuration utility that do not correspond to scheduled administrative activity
- HTTP requests to the Configuration utility with Referer or Origin headers pointing to untrusted external domains
- Audit log entries showing state-changing actions immediately following administrator visits to external links or email-delivered URLs
Detection Strategies
- Inspect BIG-IP audit logs (/var/log/audit) for configuration modifications and correlate them with administrator browsing activity
- Deploy web application firewall (WAF) rules that flag dashboard POST/PUT/DELETE requests missing valid CSRF tokens or with mismatched Origin headers
- Monitor authenticated administrator sessions for requests originating from non-management network segments
Monitoring Recommendations
- Centralize BIG-IP management plane logs in a SIEM and alert on configuration changes outside of approved change windows
- Enable browser security telemetry on administrator workstations to detect navigation to suspicious URLs that target management interfaces
- Review session activity for short-interval, high-impact actions that align with CSRF exploitation patterns
How to Mitigate CVE-2026-40703
Immediate Actions Required
- Apply the fixed software versions listed in F5 Security Advisory K35544022 as soon as they are validated in your environment
- Restrict access to the BIG-IP Configuration utility to a dedicated, isolated management network
- Require administrators to log out of the Configuration utility when not actively performing management tasks
Patch Information
F5 has published remediation guidance in Security Advisory K35544022. Customers should consult the advisory for the exact fixed versions corresponding to their installed BIG-IP branch. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch.
Workarounds
- Limit Configuration utility access to trusted management IP ranges using httpd allow lists or network ACLs
- Use a dedicated browser profile or isolated workstation solely for BIG-IP administration to prevent cross-site interaction with untrusted sites
- Enforce short administrative session timeouts to reduce the window in which a CSRF payload can succeed
- Educate administrators not to browse untrusted sites or click external links while authenticated to the management interface
# Example: restrict BIG-IP Configuration utility to a management subnet
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 127.0.0.0/8 }
tmsh save sys config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
