This vulnerability (CVE-2026-40631) in F5 BIG-IP allows an authenticated user with elevated roles (Resource Administrator or Administrator) to manipulate configuration objects via the iControl SOAP API, resulting in privilege escalation. The issue is categorized under CWE-552, indicating files or directories accessible to external parties. The CVSS 3.1 base score is 8.7, reflecting high impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required. Affected versions include 16.1.0, 17.1.0, 17.5.0, and 21.0.0. The vendor has not published a patch or official remediation at this time, and the vulnerability is not known to be exploited in the wild.

Successful exploitation allows an attacker with existing elevated privileges to escalate their privileges further by modifying configuration objects, potentially compromising system confidentiality and integrity. The vulnerability does not impact availability. Since the attacker must already have Resource Administrator or Administrator roles, the threat is limited to insiders or compromised accounts with these privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the iControl SOAP interface to trusted administrators only and monitor for unusual configuration changes. Review and limit the assignment of Resource Administrator and Administrator roles to minimize risk.