This vulnerability (CVE-2026-40698) in F5 BIG-IP and BIG-IQ products involves improper neutralization of special elements used in OS commands (CWE-77), enabling command injection. An attacker with Resource Administrator privileges can exploit this via iControl REST API or TMOS shell to create SNMP configuration objects, resulting in privilege escalation. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with scope change. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. No patch or official remediation level has been published as of the data provided.

Successful exploitation allows an authenticated attacker with Resource Administrator privileges to escalate their privileges by injecting OS commands through SNMP configuration creation interfaces. This can lead to full compromise of confidentiality and integrity of the affected system. Availability impact is not indicated. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor F5's advisories for updates. Until a patch is available, restrict Resource Administrator access to trusted personnel only and limit exposure of management interfaces such as iControl REST and TMOS shell to trusted networks.