CVE-2026-39458
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
When a BIG-IP is configured with DNS caching (such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
Undisclosed traffic could cause TMM to crash, leading to service disruptions and potential unavailability of the system.
Recommendation
It is recommended to monitor network traffic and apply available patches from the vendor, as well as consider upgrading to a supported BIG-IP version.
Other vulnerabilities in F5 BIG-IP
See all- CVE-2016-9250High
In F5 BIG-IP versions 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.
- CVE-2016-9256High
In F5 BIG-IP versions 12.1.0 through 12.1.2, a race condition can occur that may delay the enforcement of permissions by iControl. If the role_map is not reloaded after permissions are changed, a user may gain access to resources they should not have access to.
- CVE-2016-9253High
In F5 BIG-IP versions 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
- CVE-2016-9251High
In F5 BIG-IP versions 12.0.0 through 12.1.2, an authenticated attacker may gain elevated privileges through a crafted iControl REST connection.
- CVE-2016-9252High
The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, allowing remote attackers to cause a denial-of-service (DoS) through unspecified vectors.
- CVE-2016-5020High
F5 BIG-IP versions before 12.0.0 HF3 allow remote authenticated users to modify the account configuration of users with the Resource Administration role, potentially gaining privileges via a crafted external Extended Application Verification (EAV) monitor script.
- CVE-2016-4545High
Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service through resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake.
- CVE-1999-1550Medium
The bigconf.conf file in F5 BIG/ip version 2.1.2 and earlier allows remote attackers to read arbitrary files by specifying the target file in the 'file' parameter.
- CVE-2026-40629High
A vulnerability in SSL profiles on a virtual server can cause it to stop processing new client connections due to undisclosed traffic. The issue affects software versions that have not reached End of Technical Support.
- CVE-2026-40462Medium
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command, allowing an authenticated attacker to view sensitive information.
Original NVD description (English source)
When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.