BIG-IP CVE-2026-40618

Requires BIG-IP configured with SSL profiles on virtual servers AND deployed either as Virtual Edition without Intel QuickAssist Technology hardware OR as physical appliance with database variable crypto.hwacceleration manually set to disabled (non-default configuration). Default hardware appliance deployments with enabled hardware crypto acceleration are NOT vulnerable. No authentication, user interaction, or privileged access required for exploitation - affects any network-accessible SSL virtual server meeting the software crypto conditions. Standard BIG-IP deployments using hardware-accelerated cryptography are protected; vulnerability is limited to software crypto code paths only.

Real-world risk is moderate despite the High CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation requirements - network-accessible, low complexity, no authentication or user interaction. However, several factors constrain practical impact: the vulnerability requires specific non-default configurations (software crypto mode), affects availability only without data compromise (C:N/I:N/A:H), and the vendor describes triggering traffic as 'undisclosed' rather than readily weaponizable. Absence from CISA KEV and lack of public exploit code suggests attackers have not prioritized this vulnerability, likely because targeted environments (VE without QAT or manually disabled hardware acceleration) represent a subset of BIG-IP deployments. Organizations running BIG-IP in these specific configurations face genuine DoS risk from remote actors, but this is not a widespread exploitation scenario. The SSVC framework would likely classify this as 'scheduled' patching priority rather than emergency - exploitation status is none, technical impact is partial (availability only), and automatable denial-of-service has lower urgency than RCE or data exposure vulnerabilities.

An external attacker identifies a target BIG-IP Virtual Edition instance or hardware appliance with disabled crypto acceleration by fingerprinting SSL/TLS implementation characteristics. The attacker crafts specific SSL traffic patterns (exact payload structure undisclosed by vendor) and transmits them to virtual servers configured with SSL profiles. The malformed traffic triggers the buffer calculation flaw (CWE-131) in TMM's software crypto path, causing immediate process termination and disrupting all traffic processing on that TMM instance until automatic restart completes.