CVE-2026-59762
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in the HTTP/2 profile on a BIG-IP virtual server allows an unauthenticated attacker to remotely cause increased memory utilization. This can lead to system performance degradation until the TMM process is forced or manually restarted.
Risk Assessment
An attacker can cause a denial-of-service (DoS) condition in the data plane, disrupting applications served by BIG-IP. The issue is limited to the data plane and does not affect the control plane.
Recommendation
Immediately update BIG-IP to a patched version addressing CVE-2026-59762. If patching is not possible, consider temporarily disabling the HTTP/2 profile on affected virtual servers.
Other vulnerabilities in BIG-IP
See all- CVE-2017-6168High
BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.
- CVE-2026-40698High
A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).
- CVE-2026-40618High
A vulnerability in BIG-IP allows TMM termination by undisclosed traffic when an SSL profile is configured on Virtual Edition without QAT or on hardware with disabled hardware acceleration.
- CVE-2026-40061High
In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.
- CVE-2026-40060High
A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.
- CVE-2026-39455High
In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.
- CVE-2026-32673High
A vulnerability in BIG-IP scripted monitors allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.
Original NVD description (English source)
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.