CVE-2026-39458CWE-824

CVE-2026-39458

High · published May 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2026-05-13T20:16Z
Affected products (84)
ProductVersionsFixed in
f5/big-ip_access_policy_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_access_policy_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_advanced_firewall_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_advanced_firewall_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_advanced_web_application_firewall≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_advanced_web_application_firewall≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_analytics≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_analytics≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_application_acceleration_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_application_acceleration_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_application_security_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_application_security_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_application_visibility_and_reporting≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_application_visibility_and_reporting≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_automation_toolchain≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_automation_toolchain≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_carrier-grade_nat≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_carrier-grade_nat≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_container_ingress_services≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_container_ingress_services≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_ddos_hybrid_defender≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_ddos_hybrid_defender≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_domain_name_system≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_domain_name_system≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_edge_gateway≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_edge_gateway≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_fraud_protection_service≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_fraud_protection_service≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_global_traffic_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_global_traffic_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_link_controller≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_link_controller≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_local_traffic_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_local_traffic_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_policy_enforcement_manager≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_policy_enforcement_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_ssl_orchestrator≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_ssl_orchestrator≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_webaccelerator≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_webaccelerator≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_websafe≥ 17.1.0, ≤ 17.1.3—
f5/big-ip_websafe≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_access_policy_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_advanced_firewall_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_advanced_web_application_firewall≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_analytics≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_application_acceleration_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_application_security_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_application_visibility_and_reporting≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_automation_toolchain≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_carrier-grade_nat≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_container_ingress_services≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_ddos_hybrid_defender≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_domain_name_system≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_edge_gateway≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_fraud_protection_service≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_global_traffic_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_link_controller≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_local_traffic_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_policy_enforcement_manager≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_ssl_orchestrator≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_webaccelerator≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_websafe≥ 16.1.0, ≤ 16.1.6—
f5/big-ip_access_policy_managerall versions—
f5/big-ip_advanced_firewall_managerall versions—
f5/big-ip_advanced_web_application_firewallall versions—
f5/big-ip_analyticsall versions—
f5/big-ip_application_acceleration_managerall versions—
f5/big-ip_application_security_managerall versions—
f5/big-ip_application_visibility_and_reportingall versions—
f5/big-ip_automation_toolchainall versions—
f5/big-ip_carrier-grade_natall versions—
f5/big-ip_container_ingress_servicesall versions—
f5/big-ip_ddos_hybrid_defenderall versions—
f5/big-ip_domain_name_systemall versions—
f5/big-ip_edge_gatewayall versions—
f5/big-ip_fraud_protection_serviceall versions—
f5/big-ip_global_traffic_managerall versions—
f5/big-ip_link_controllerall versions—
f5/big-ip_local_traffic_managerall versions—
f5/big-ip_policy_enforcement_managerall versions—
f5/big-ip_ssl_orchestratorall versions—
f5/big-ip_webacceleratorall versions—
f5/big-ip_websafeall versions—
References (1)
EPSS history
Timeline
  • 13 MAY 14:12Z
    BIG-IP DNS Cache vulnerability
    cvelistv5