Which versions of BIG-IP Configuration utility are affected by CVE-2026-39455?

CVE-2026-39455 is a high-severity denial-of-service vulnerability in F5 BIG-IP Configuration utility that allows unauthenticated remote attackers to exhaust system resources and completely disable…. A patch is available.

How to fix or mitigate CVE-2026-39455?

Within 24 hours: Identify all BIG-IP Configuration utility instances with LDAP authentication enabled and verify current version against F5 advisory; confirm patch availability for your specific version. Within 7 days: Apply vendor-released patch to all affected BIG-IP systems, prioritizing production environments; test patched systems in non-production environments first. Within 30 days: Complete patch deployment across all BIG-IP infrastructure and document remediation status.

BIG-IP Configuration utility CVE-2026-39455

Q: What is the CVSS score of CVE-2026-39455?

CVE-2026-39455 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29966 HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-05-13 f5

GHSA-6225-9whv-x529

Information Disclosure Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:50 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor exhaustion in the httpd process when LDAP authentication is enabled. The attack achieves complete denial of service (CVSS A:H) through network-accessible undisclosed traffic patterns. F5 has released patches addressing this vulnerability. EPSS data not available, not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-772 (Missing Release of Resource after Effective Lifetime), specifically affecting file descriptor management in the httpd daemon of F5 BIG-IP Configuration utility. When LDAP authentication is configured for the management interface, certain traffic patterns cause the httpd process to leak or fail to release file descriptors - the kernel-level handles for open network connections, files, and sockets. Unix-like systems have per-process file descriptor limits (typically ulimit -n), and exhausting this pool prevents the process from accepting new connections or opening files, effectively disabling the Configuration utility. The affected CPE (cpe:2.3:a:f5:big-ip) indicates the application-layer Configuration utility specifically, not the underlying BIG-IP system software in general. The F5 advisory K000160874 provides vendor-confirmed details on affected versions and remediation.

RemediationAI

Apply vendor-released patches documented in F5 Security Advisory K000160874 (https://my.f5.com/manage/s/article/K000160874), which specifies exact fixed versions for supported BIG-IP releases. If immediate patching is not feasible, implement compensating controls specific to this attack vector: restrict network access to the Configuration utility to trusted management networks only via firewall rules or BIG-IP's built-in management interface ACLs, reducing attack surface to internal administrators. Alternatively, switch from LDAP authentication to local authentication or RADIUS/TACACS+ if operationally acceptable, which eliminates the vulnerable code path entirely - though this may impact centralized identity management workflows. Monitor httpd process file descriptor usage via 'lsof -p <httpd_pid> | wc -l' and configure alerting for abnormal growth approaching system limits. Note that access restriction does not fix the underlying resource leak but significantly reduces exploitability from AV:N to AV:A (adjacent network) or AV:L (local) in practice.