F5 BIG-IP CVE-2026-40423

Requires F5 BIG-IP with a SIP profile explicitly configured and applied to a virtual server-SIP profiles are not enabled by default and require administrator action to deploy for VoIP/unified communications traffic handling. The target virtual server must be network-accessible to the attacker (commonly internet-facing for SIP trunk scenarios or accessible from untrusted network segments). Exploitation limits: Attack is restricted to causing availability impact (TMM crash/restart); it does not enable code execution, privilege escalation, or data exfiltration. No user interaction required (UI:N). No authentication required (PR:N). Successful exploitation depends on BIG-IP processing the attacker's SIP traffic through an affected virtual server configuration, meaning organizations not using SIP functionality are not at risk regardless of software version.

This represents a significant availability risk for organizations using BIG-IP with SIP profiles in production VoIP/UC environments, though real-world impact is limited by deployment-specific prerequisites. CVSS 4.0 score of 8.7 reflects severe availability impact through unauthenticated network exploitation with low attack complexity, making this a priority for affected deployments. However, exploitation requires the target to have SIP profile functionality explicitly enabled and configured on a virtual server-not a default configuration for most BIG-IP deployments. No EPSS score is available for this 2026 CVE, and it is not listed in CISA KEV, indicating no confirmed widespread or active exploitation at time of analysis. The attack is automatable once prerequisites are met (AV:N/AC:L/PR:N), enabling potential for scripted attacks against exposed SIP-enabled BIG-IP instances. Risk is highest for telecommunications providers, contact centers, and enterprises with BIG-IP serving as SIP proxy or session border controller. For organizations not using SIP profiles, this vulnerability presents zero practical risk despite the high CVSS score. Vendor has released patches across all supported branches, significantly reducing ongoing risk for organizations with active patch management programs.

An unauthenticated remote attacker identifies an F5 BIG-IP system with a SIP profile configured on an internet-facing virtual server through network reconnaissance or banner grabbing on standard SIP ports (5060/5061). The attacker crafts malformed SIP messages exploiting resource allocation flaws in TMM's SIP parsing logic and transmits them to the virtual server. The undisclosed traffic triggers uncontrolled resource consumption or buffer handling errors in the TMM process, causing it to crash and terminate. All traffic processing through the affected BIG-IP instance halts until TMM restarts, creating a complete service outage for applications behind that virtual server. The attacker can repeat this process to sustain denial of service, disrupting VoIP communications, contact center operations, or other SIP-dependent services.