CVE-2026-42409

CVE-2026-42409 affects BIG-IP: when an HTTP/2 profile is used with an iRule containing HTTP::redirect or HTTP::respond on a virtual server, undisclosed requests can crash the Traffic Management Microkernel (TMM), causing DoS. Evidence in connected docs shows affected products: BIG-IP (all modules...

CVE-2026-41227

CVE-2026-41227 affects BIG-IP with HTTP/2 Layer 7 DoS Protection enabled. Undisclosed traffic can trigger a memory increase that causes the Traffic Management Microkernel (TMM) process to terminate, leading to DoS on the data plane. The advisory notes EoTS-filtering is applied to evaluation, and ...

CVE-2026-40060

CVE-2026-40060 affects BIG-IP Advanced WAF/ASM when a security policy is configured on a virtual server; undisclosed requests can cause the bd process to terminate, resulting in DoS with traffic disruption as the process restarts. In F5 advisories, vulnerable branches include BIG-IP Advanced WAF/...

CVE-2026-40061

CVE-2026-40061 affects BIG-IP DNS and relates to an undisclosed iControl REST and tmsh command that an authenticated attacker with Resource Administrator or Administrator privileges can use to execute arbitrary system commands with higher privileges. In Appliance mode, exploit could cross a secur...

CVE-2026-40061 iControl REST and tmsh vulnerability

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode...

CVE-2026-40618 BIG-IP SSL/TLS vulnerability

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition VE without Intel QuickAssist Technology QAT or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel TMM to...

CVE-2026-40618

CVE-2026-40618 affects BIG-IP SSL/TLS when an SSL profile is on a virtual server and either QAT is not available (VE) or crypto.hwacceleration is disabled on hardware. This can cause TMM to terminate, resulting in a data-plane DoS with traffic disruption as TMM restarts. Affected BIG-IP lines inc...

CVE-2026-41956 BIG-IP TMM Vulnerability

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-41956

CVE-2026-41956 affects BIG-IP TMM. When a classification profile is configured on a UDP virtual server, undisclosed requests can cause TMM termination, producing DoS on the BIG-IP data plane. From F5 advisories, vulnerable lines include BIG-IP (all modules) UDP virtual servers across 17.x and 21....

CVE-2026-42920

CVE-2026-42920 affects BIG-IP DTLS: when a Client SSL profile has Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS as TMM restarts. The F5 advisory notes this is a data-plane issue with rem...

CVE-2026-41218 BIG-IP PEM iRules vulnerability

When BIG-IP PEM iRules are configured on a virtual server iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End...

CVE-2026-42919

A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-40629 BIG-IP SSL/TLS vulnerability

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-42919 F5 BIG-IP Appliance Mode Vulnerability

A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-42919

Affected product: BIG-IP ( appliance mode feature ). The issue allows an authenticated administrator to bypass appliance mode security and execute arbitrary commands with higher privileges, a control‑plane only escalation with no data‑plane exposure as described in the advisory. For BIG-IP Next/1...

CVE-2026-42919 F5 BIG-IP Appliance Mode Vulnerability

A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-40629 BIG-IP SSL/TLS vulnerability

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-42781 BIG-IP FastL4 virtual server vulnerability

When embedded Packet Velocity Acceleration ePVA acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel TMM resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-42781

The CVE-2026-42781 issue affects BIG-IP with embedded ePVA acceleration enabled. A local network attacker can cause the ePVA/TMM to escalate resource utilization, degrading system performance and potentially causing DoS on vulnerable rSeries/VELOS deployments that support ePVA. That impact is a d...

CVE-2026-42781 BIG-IP FastL4 virtual server vulnerability

When embedded Packet Velocity Acceleration ePVA acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel TMM resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...