BIG-IP Advanced WAF CVE-2026-40060

Exploitation requires that the target BIG-IP instance has an Advanced WAF or Application Security Manager (ASM) security policy actively configured and applied to at least one virtual server. Systems running BIG-IP without WAF/ASM modules enabled, or those with modules licensed but no policies attached to virtual servers, are not vulnerable. No authentication, user interaction, or non-default configuration beyond the presence of an active security policy is required. The attack vector is network-based with low complexity (AV:N/AC:L/PR:N/UI:N), meaning remote unauthenticated attackers can exploit default configurations of BIG-IP Advanced WAF deployments. The specific nature of the 'undisclosed requests' that trigger the vulnerability has not been publicly detailed by F5, limiting defenders' ability to write preventative signatures but also reducing immediate attacker knowledge. High-availability configurations with automatic failover may experience reduced impact duration but remain exploitable.

This represents a significant operational risk for production WAF deployments despite the availability-only impact. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation with low attack complexity, meaning any internet-facing BIG-IP WAF instance with an active security policy is vulnerable to trivial denial-of-service attacks. The CVSS 7.5 score accurately reflects high availability impact without confidentiality or integrity compromise. However, real-world severity depends heavily on deployment context: organizations using BIG-IP as their primary edge WAF face direct exposure, while those with redundant HA pairs or upstream DDoS mitigation may have reduced impact. The 'undisclosed requests' language suggests F5 has not publicly detailed the exploit mechanism, reducing immediate weaponization risk but also limiting defenders' ability to write detection signatures. No EPSS score provided prevents quantitative exploitation probability assessment. Not present in CISA KEV, indicating no confirmed active exploitation campaigns. The availability of a vendor patch elevates this from unmanageable to operationally addressable, though patch deployment windows on production edge devices often require careful planning. Priority should be MEDIUM-HIGH for internet-facing deployments with single points of failure, MEDIUM for HA configurations with failover capabilities.

An external attacker identifies an internet-facing F5 BIG-IP Advanced WAF instance protecting a web application (common in enterprise and financial services environments). Without requiring authentication or credentials, the attacker crafts HTTP requests with specific characteristics that trigger the unchecked error condition in the bd process policy evaluation logic. These malformed requests are sent to the virtual server configured with the WAF policy, causing the bd process to terminate and disrupting service for all users behind that virtual server. If the attacker repeats this attack or targets multiple virtual servers, they can achieve sustained denial of service against the organization's web applications until administrators restart services or apply patches.