CVE-2026-40435 BIG-IP httpd access control vulnerability

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-40435 BIG-IP httpd access control vulnerability

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-40703 BIG-IP Configuration utility CSRF vulnerability

A cross-site request forgery CSRF vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-40703 BIG-IP Configuration utility CSRF vulnerability

A cross-site request forgery CSRF vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-40703

The CVE-2026-40703 entry describes a CSRF vulnerability in the BIG-IP Configuration utility dashboard. A remote, unauthenticated attacker can entice an authenticated user to issue crafted requests, allowing the attacker to create, modify, and delete dashboard items as that user. This is a control...

K000160932: Quarterly Security Notification (May 2026)

Security Advisory Description On May 13, 2026, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. You can watch t...

K000161107: BIG-IP tmsh vulnerability CVE-2026-41217

Security Advisory Description A vulnerability exists in an undisclosed BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful...

K000160862: BIG-IP FastL4 virtual server vulnerability CVE-2026-42781

Security Advisory Description When embedded Packet Velocity Acceleration ePVA acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel TMM resource utilization. CVE-2026-42781 Impact System performance can degrade until the TM...

K000158978: BIG-IP SSL/TLS vulnerability CVE-2026-40629

Security Advisory Description When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. CVE-2026-40629 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote,...

K000157895: BIG-IP qkview vulnerability CVE-2026-41219

Security Advisory Description An improper sanitization vulnerability exists in the BIG-IP qkview utility that allows a low-privileged attacker to read sensitive information from a QKView file. CVE-2026-41219 Impact An attacker may exploit this vulnerability to read sensitive information from a...

K000149743: BIG-IP SSL Orchestrator vulnerability CVE-2026-42780

Security Advisory Description A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. CVE-2026-42780 Impact An authenticated attacker with high privilege may exploit this...

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

K000160857: Appliance mode iControl REST vulnerability CVE-2026-34176

Security Advisory Description When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. CVE-2026-34176 Impact In Appliance mode, this...

K000160863: iControl REST and tmsh vulnerability CVE-2026-39459

Security Advisory Description A vulnerability exists in iControl REST and the TMOS Shell tmsh where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. CVE-2026-39459 Impact This vulnerability may allow...

K000161018: iControl REST and tmsh vulnerability CVE-2026-42937

Security Advisory Description Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell tmsh arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. CVE-2026-42937 Impact An...

K000161022: iControl REST and tmsh vulnerability CVE-2026-41959

Security Advisory Description Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell tmsh network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems...

K000161068: NGINX ngx_quic_module vulnerability CVE-2026-40460

Security Advisory Description When NGINX Plus or NGINX Open Source is configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. CVE-2026-40460 Impact This vulnerability allows a remote,...

K000160972: BIG-IP and BIG-IQ privilege escalation vulnerability CVE-2026-32643

Security Advisory Description A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. CVE-2026-32643 Impact This vulnerability may allow...

K000160971: BIG-IP and BIG-IQ privilege escalation vulnerability CVE-2026-42406

Security Advisory Description A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. CVE-2026-42406 Impact This vulnerability may allow...

K000160788: iControl REST and tmsh vulnerability CVE-2026-40061

Security Advisory Description When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher...