CVE-2026-40703 is a CWE-352 cross-site request forgery vulnerability in the dashboard of the F5 BIG-IP Configuration utility. It affects versions 16.1.0, 17.1.0, and 17.5.0. The CVSS 3.1 base score is 5.4 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vulnerability allows an attacker to trick an authenticated user into submitting unauthorized requests to the BIG-IP dashboard. No patch or official remediation level has been disclosed by the vendor. No exploits are known to be active in the wild.

The vulnerability can lead to unauthorized modification or disruption of the BIG-IP Configuration utility via CSRF attacks, impacting the integrity and availability of the system. Confidentiality is not affected. Since no exploits are known in the wild, the immediate risk appears limited. However, successful exploitation requires user interaction and an authenticated session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure of the BIG-IP dashboard to trusted networks and ensure users are aware of phishing and social engineering risks that could trigger CSRF attacks. Monitor vendor communications for updates on patches or mitigations.