CVE-2026-66842

BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.

When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). This is a data plane issue; there is no control plane exposure. The BIG-IP system in Appliance mode is also vulnerable.

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.

A vulnerability in the HTTP/2 profile on a BIG-IP virtual server allows an unauthenticated attacker to remotely cause increased memory utilization. This can lead to system performance degradation until the TMM process is forced or manually restarted.

A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).

A vulnerability in BIG-IP allows TMM termination by undisclosed traffic when an SSL profile is configured on Virtual Edition without QAT or on hardware with disabled hardware acceleration.

In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.

A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.

In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.

A vulnerability in BIG-IP scripted monitors allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.