Which versions of F5 BIG-IP are affected by CVE-2026-40423?

F5 BIG-IP versions 16.1.0 through 21.0.0.1 contain a high-severity vulnerability in the Traffic Management Microkernel that allows unauthenticated attackers to crash the service and cause complete…. A patch is available.

How to fix or mitigate CVE-2026-40423?

Within 24 hours: Identify all BIG-IP instances running versions 16.1.0-21.0.0.1 with SIP profiles configured via administrative console audit. Within 7 days: Apply vendor-released patches to all affected systems prioritizing SIP-enabled instances; test in non-production environment first. Within 30 days: Complete patching of all affected BIG-IP deployments across production and secondary environments; validate SIP traffic handling post-patch.

F5 BIG-IP CVE-2026-40423

Q: What is the CVSS score of CVE-2026-40423?

CVE-2026-40423 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29972 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-13 f5

GHSA-3f74-cm4w-65c4

Denial Of Service Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 13, 2026 - 16:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:51 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote attackers to cause complete service disruption when a SIP profile is configured on a virtual server. The vulnerability requires specific configuration (SIP profile deployment) and enables denial of service through undisclosed malformed SIP traffic. EPSS data not available; no active exploitation confirmed by CISA KEV at time of analysis. Vendor patch available across all affected version branches with specific fix versions identified.

Technical ContextAI

This vulnerability affects F5's BIG-IP Application Delivery Controller platform, specifically the Traffic Management Microkernel (TMM) component responsible for high-performance traffic processing and load balancing. The Session Initiation Protocol (SIP) is a signaling protocol commonly used for VoIP, video conferencing, and real-time communication applications. When BIG-IP is configured with SIP profiles to handle VoIP traffic inspection, routing, or security functions, the TMM process becomes vulnerable to specially crafted SIP traffic. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the TMM fails to properly validate or limit resource consumption when processing certain SIP messages, leading to process termination. The CVSS 4.0 vector shows network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), with high availability impact (VA:H) but no confidentiality or integrity impacts, consistent with a denial-of-service condition.

RemediationAI

Upgrade to patched BIG-IP versions immediately: 21.0.0.2 or later for 21.x branch, 17.5.1.6 or later for 17.5.x branch, or 17.1.3.2 or later for 17.1.x branch. Organizations running 16.1.x versions must migrate to a supported branch as this version line has reached End of Technical Support and will not receive security fixes. If immediate patching is not feasible, implement the following compensating controls with their associated trade-offs: (1) Remove SIP profiles from virtual servers if SIP inspection/processing is not business-critical-this eliminates the attack surface entirely but disables SIP-specific application-layer visibility and control; (2) Restrict network access to SIP virtual servers using firewall rules or BIG-IP ACLs to permit only trusted source IP ranges (known SIP endpoints/trunks)-this reduces exposure to internet-originated attacks but requires maintaining accurate IP allowlists and may break dynamic SIP routing scenarios; (3) Deploy rate-limiting on SIP virtual servers to constrain request volume-this may mitigate resource exhaustion but could impact legitimate high-volume SIP traffic during peak usage. Reference F5 Security Advisory K000161023 for additional deployment-specific guidance and confirm fix applicability for your specific BIG-IP modules and configurations.