CVE-2026-40618

BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.

A vulnerability in the HTTP/2 profile on a BIG-IP virtual server allows an unauthenticated attacker to remotely cause increased memory utilization. This can lead to system performance degradation until the TMM process is forced or manually restarted.

A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).

In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.

A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.

In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.

A vulnerability in BIG-IP scripted monitors allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.