BIG-IP Configuration utility CVE-2026-39455

BIG-IP Configuration utility must be explicitly configured to use Lightweight Directory Access Protocol (LDAP) for authentication (not the default local authentication mode). The attack targets network-accessible management interfaces, so the Configuration utility must be reachable from the attacker's network position. Default BIG-IP installations using local authentication or other authentication methods (RADIUS, TACACS+, Active Directory via other mechanisms) are NOT vulnerable. The vendor redacted specific traffic patterns as 'undisclosed,' suggesting the exploit may require knowledge of specific LDAP authentication flow characteristics. Exploitation is limited to causing management plane denial of service - data plane traffic processing (actual load balancing, proxying, firewall functions) remains unaffected, and no data exfiltration or code execution is possible (CVSS C:N/I:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a remotely exploitable denial-of-service vulnerability requiring no authentication, low attack complexity, and no user interaction - meeting SSVC 'automatable' criteria. However, real-world risk is significantly constrained by the exploitation condition: LDAP authentication must be explicitly configured for the Configuration utility, which is not a default deployment mode for most BIG-IP installations. The 7.5 CVSS score reflects maximum potential impact but does not account for this prerequisite. Absence from CISA KEV suggests targeted rather than opportunistic exploitation. The vulnerability impacts management plane availability only (Configuration utility), not data plane traffic processing, limiting business impact to administrative operations. Priority should be high for environments using LDAP-authenticated management access, moderate for default deployments where the condition is not met. Key missing data: EPSS score unavailable, specific affected version ranges not provided in CVE data, exploit complexity details redacted by vendor ('undisclosed traffic').

An external attacker identifies a BIG-IP management interface accessible over the internet (common in cloud deployments or poorly segmented networks). By sending specially crafted traffic patterns to the Configuration utility's LDAP-authenticated login interface, the attacker triggers file descriptor leaks in the httpd process. Over minutes to hours, the descriptor pool exhausts, causing the Configuration utility to become unresponsive and preventing legitimate administrators from accessing the management interface until the httpd process is restarted. No public proof-of-concept code identified at time of analysis.