Which versions of BIG-IP Advanced WAF are affected by CVE-2026-40060?

F5 BIG-IP Advanced WAF and ASM contain a denial-of-service vulnerability allowing unauthenticated remote attackers to crash the bd process and disrupt application availability with low attack…. A patch is available.

How to fix or mitigate CVE-2026-40060?

Within 24 hours: Identify all F5 BIG-IP Advanced WAF and ASM instances in production and map them to F5 advisory K000160727 to determine affected versions. Within 7 days: Apply vendor patch per F5 advisory K000160727 to all affected systems following F5's documented upgrade procedure; perform rollback testing in staging beforehand. Within 30 days: Conduct post-patch validation across all WAF and ASM deployments and document remediation completion.

BIG-IP Advanced WAF CVE-2026-40060

Q: What is the CVSS score of CVE-2026-40060?

CVE-2026-40060 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29969 HIGH

Unchecked Return Value (CWE-252)

2026-05-13 f5

GHSA-p3wj-9p5j-v2f9

Information Disclosure Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:48 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when processing specially crafted requests against virtual servers with active security policies. Undisclosed malformed requests cause the bd process to terminate, disrupting service availability. Remote unauthenticated attackers can exploit this with low complexity (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) achieving high availability impact (CVSS 7.5). EPSS data not provided, no active exploitation confirmed via CISA KEV at time of analysis. Vendor patch available per F5 advisory K000160727.

Technical ContextAI

F5 BIG-IP Advanced WAF and ASM provide web application firewall capabilities through security policies attached to virtual servers. The bd process (BIG-IP daemon) handles traffic inspection and policy enforcement. This vulnerability stems from unchecked return status (CWE-252), meaning the bd process fails to properly validate or handle error conditions when processing certain request types. When exploitation occurs, the bd process crashes rather than gracefully handling the malformed input, resulting in service disruption. The CPE identifier cpe:2.3:a:f5:big-ip indicates this affects the core BIG-IP application platform. The vulnerability specifically requires that a WAF or ASM security policy be actively configured and applied to a virtual server, suggesting the flaw exists in the policy evaluation or request parsing logic rather than baseline BIG-IP routing functionality.

RemediationAI

Apply the vendor-released patch detailed in F5 Security Advisory K000160727 (https://my.f5.com/manage/s/article/K000160727), which provides version-specific upgrade paths and hotfix availability. Organizations should prioritize patching internet-facing BIG-IP instances with active WAF/ASM policies. If immediate patching is infeasible due to change control or maintenance window constraints, implement the following compensating controls with documented trade-offs: deploy upstream rate limiting or web application firewall filtering to pre-screen requests before they reach BIG-IP (adds latency and infrastructure cost), configure BIG-IP high-availability pairs with health monitoring to enable automatic failover when bd process crashes (masks symptoms but does not prevent exploitation), or temporarily disable specific WAF policy components if F5 advisory identifies particular signature sets as vulnerable (reduces security posture and may expose applications to other attacks). Note that disabling WAF policies entirely eliminates the vulnerability but defeats the purpose of the security investment. For production edge deployments, coordinate patching with DDoS mitigation providers to handle potential service disruption. Test patches in staging environments with representative traffic profiles, as WAF policy changes can introduce false positives affecting legitimate users.