This vulnerability (CVE-2026-40699) in F5 BIG-IP arises from improper neutralization of data within XPath expressions (CWE-643) in undisclosed pages of the Configuration utility. It allows a low-privileged authenticated attacker to gain access to sensitive information that is not publicly disclosed. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a confidentiality impact only. No integrity or availability impacts are noted. No patch or official remediation level is currently documented, and no known exploits have been reported.

The vulnerability allows unauthorized disclosure of sensitive information to low-privileged authenticated users. There is no reported impact on data integrity or system availability. No known exploitation in the wild has been observed. The confidentiality impact is rated high within the CVSS vector, but overall severity is medium due to required privileges and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level is currently documented, users should restrict access to the Configuration utility to trusted administrators and monitor for updates from F5. Avoid using affected versions if possible until a patch or official mitigation is released.