CVE-2026-40698 is an OS command injection vulnerability (CWE-77) in F5 BIG-IP and BIG-IQ systems. An attacker with Resource Administrator privileges can exploit this flaw by creating SNMP configuration objects through iControl REST API or the TMOS shell (tmsh), resulting in privilege escalation. The vulnerability impacts multiple versions of BIG-IP software, specifically 21.0.0, 17.5.0, 17.1.0, and 16.1.0. The CVSS v3.1 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability. No vendor advisory or patch is currently available, and no known exploits have been reported in the wild.

Successful exploitation allows a highly privileged, authenticated attacker to escalate privileges by injecting OS commands through SNMP configuration creation mechanisms. This can compromise confidentiality and integrity of the affected system. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Resource Administrator role assignments to trusted personnel only and monitor for suspicious activity related to SNMP configuration changes. No official remediation or temporary fix is currently documented by the vendor.