Which versions of F5 BIG-IP DNS are affected by CVE-2026-39458?

F5 BIG-IP DNS systems with DNS caching enabled are vulnerable to remote denial-of-service attacks that crash the Traffic Management Microkernel, resulting in complete service disruption.. A patch is available.

How to fix or mitigate CVE-2026-39458?

Within 24 hours: Inventory all F5 BIG-IP DNS deployments and identify systems with DNS cache-enabled profiles on virtual servers. Within 7 days: Test vendor patch from F5 advisory K000160945 in a non-production environment and develop a change management plan for production deployment. Within 30 days: Deploy the vendor-released patch to all affected BIG-IP DNS systems in production, prioritizing systems serving critical DNS infrastructure.

F5 BIG-IP DNS CVE-2026-39458

Q: What is the CVSS score of CVE-2026-39458?

CVE-2026-39458 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29967 HIGH

Access of Uninitialized Pointer (CWE-824)

2026-05-13 f5

GHSA-9w3c-r5r8-2fg7

Information Disclosure Memory Corruption Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:51 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When a BIG-IP DNS profile enabled with DNS cache is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles on virtual servers. Remote unauthenticated attackers can crash TMM using undisclosed malicious traffic patterns, causing complete service disruption. CVSS 7.5 High severity with network vector and low complexity. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Vendor patch available per F5 K000160945.

Technical ContextAI

BIG-IP DNS (formerly GTM) is F5's global server load balancing and DNS resolution platform. The vulnerability affects the Traffic Management Microkernel (TMM), the core packet processing engine handling all BIG-IP traffic. DNS caching functionality, when enabled via a DNS profile attached to a virtual server, introduces memory corruption conditions (CWE-824: Access of Uninitialized Pointer). The DNS cache maintains response records to optimize query performance, but malformed or specially crafted DNS packets trigger uninitialized pointer access, causing TMM process termination. TMM restart leads to traffic interruption across all virtual servers on the affected instance. The CPE identifier applies broadly to F5 BIG-IP product family; specific affected versions are restricted to those within active support windows per F5's EoTS policy.

RemediationAI

Apply vendor-supplied patches per F5 Security Advisory K000160945 available at https://my.f5.com/manage/s/article/K000160945. F5 typically delivers fixes via hotfix engineering builds or scheduled maintenance releases; verify the specific patched version for your active BIG-IP release train through the K-article or F5 support portal. If immediate patching is not feasible, implement these compensating controls: (1) Disable DNS cache in affected DNS profiles if performance requirements allow - eliminates attack surface but increases backend DNS query load and response latency; (2) Restrict virtual server access via ACLs or firewall rules to trusted source networks only - reduces exposure but limits legitimate external DNS resolution; (3) Enable BIG-IP High Availability (HA) active-standby or active-active clustering to ensure automatic failover during TMM crashes - minimizes downtime to failover duration (5-30 seconds) but does not prevent exploitation; (4) Implement rate-limiting on DNS virtual servers to throttle potential attack traffic - may reduce attack effectiveness but could also impact legitimate high-volume queries. Monitor TMM process restarts via /var/log/ltm logs and alert on unexpected crashes. No workaround fully mitigates the vulnerability; patching remains the definitive solution.