Threat database

CVE-2026-40698 is a high-severity OS command injection vulnerability in F5 BIG-IP and BIG-IQ systems. It allows a highly privileged, authenticated attacker with at least Resource Administrator role to create SNMP configuration objects via iControl REST or TMOS shell (tmsh), leading to privilege escalation. The vulnerability affects specific versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.

CVE-2026-42924 is a high-severity vulnerability in F5 BIG-IP affecting versions 16.1.0, 17.1.0, 17.5.0, and 21.0.0. It allows an authenticated attacker with Resource Administrator or Administrator roles to create SNMP configuration objects via the iControl SOAP interface, resulting in privilege escalation.

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40061 is a command injection vulnerability in F5 BIG-IP DNS when provisioned, affecting certain versions. It allows an authenticated user with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges. In Appliance mode deployments, exploitation can cross a security boundary. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An authenticated iControl SOAP user may be able to obtain information of other accounts.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42919 is a stack-based buffer overflow vulnerability in F5 BIG-IP systems. It affects multiple versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.0.

When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41957 is a high-severity vulnerability in F5 BIG-IP and BIG-IQ Configuration utility that allows authenticated users to execute remote code via deserialization of untrusted data. It affects specific versions including 17.5.0, 17.1.0, and 16.1.0. The vulnerability does not require user interaction and has a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.