F5 BIG-IP DNS CVE-2026-39458

Exploitation requires the target BIG-IP system to have BOTH a DNS profile with caching enabled AND that profile configured on an active virtual server processing DNS traffic. Default BIG-IP installations without DNS profiles configured are not vulnerable. The attacker must have network reachability to the virtual server's IP address and port (typically 53/UDP or 53/TCP). The DNS cache feature is commonly enabled in production environments for performance optimization, making many deployments potentially vulnerable. No user interaction, authentication, or privileged access is required (PR:N, UI:N). The vulnerability affects only systems running supported BIG-IP versions; EoTS versions are excluded from vendor evaluation and patching. Exploitation is NOT limited by DNS query legitimacy - the attack traffic itself is malicious rather than exploiting responses to legitimate queries.

Real-world risk is HIGH for exposed BIG-IP DNS systems. CVSS 7.5 correctly reflects the severity: network-accessible (AV:N), trivial exploitation complexity (AC:L), no authentication required (PR:N), and complete availability impact (A:H). Attack requires only crafting DNS traffic against a publicly exposed virtual server with DNS caching enabled - a common configuration for authoritative DNS and GSLB deployments. While no public exploit code or CISA KEV listing exists yet, the simplicity (AC:L, PR:N) makes weaponization straightforward once attack patterns are reverse-engineered from patches. F5 deliberately withholds traffic pattern details ('undisclosed traffic'), suggesting non-obvious exploitation requiring protocol-level DNS manipulation rather than simple malformed packets. Primary risk is service disruption during TMM restart (typically 30-90 seconds), but in clustered environments with proper failover, impact may be limited to brief traffic delays. Organizations with internet-facing DNS virtual servers should prioritize patching; internal-only DNS servers face lower immediate risk but remain vulnerable to insider threats or lateral movement scenarios.

An external attacker identifies an internet-facing F5 BIG-IP DNS virtual server (typically UDP/53 or TCP/53) through port scanning or DNS enumeration. The attacker crafts malicious DNS query packets exploiting the uninitialized pointer vulnerability in the DNS cache handling code. When BIG-IP processes the crafted traffic, TMM accesses an uninitialized memory pointer, triggering immediate process termination. All active connections through the BIG-IP instance drop, causing DNS resolution failures for downstream clients and potential service outages for applications relying on GSLB. TMM automatically restarts within 30-90 seconds, but repeated exploitation creates sustained denial-of-service conditions.