Which versions of BIG-IP are affected by CVE-2026-40618?

F5 BIG-IP Virtual Edition and hardware platforms are vulnerable to denial-of-service attacks when SSL profiles lack hardware crypto acceleration, allowing remote attackers to crash the Traffic…. A patch is available.

How to fix or mitigate CVE-2026-40618?

Within 24 hours: Identify all F5 BIG-IP instances (Virtual Edition and hardware) and audit SSL profile configurations for hardware crypto acceleration status. Within 7 days: Apply F5 vendor patch per advisory K000158082 to all affected BIG-IP systems, prioritizing production load balancers. Within 30 days: Verify patch deployment across all instances and enable hardware crypto acceleration on SSL profiles where feasible to reduce attack surface.

BIG-IP CVE-2026-40618

Q: What is the CVSS score of CVE-2026-40618?

CVE-2026-40618 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29976 HIGH

Incorrect Calculation of Buffer Size (CWE-131)

2026-05-13 f5

GHSA-jrwx-v3xx-xrp8

Intel Information Disclosure Big Ip Big Ip Next Spk Big Ip Next Cnf Big Ip Next For Kubernetes

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:47 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.

Technical ContextAI

This vulnerability affects F5 BIG-IP's Traffic Management Microkernel (TMM), the core traffic processing engine responsible for SSL/TLS termination and load balancing. The issue manifests specifically when SSL profiles handle cryptographic operations in software mode rather than hardware-accelerated mode - either on Virtual Edition platforms lacking Intel QuickAssist Technology (QAT) co-processors, or on physical appliances where the crypto.hwacceleration database variable has been manually disabled. The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size), suggesting a buffer sizing error in the SSL processing code path that only triggers when crypto operations run without hardware offload. The affected products span the entire BIG-IP portfolio including BIG-IP classic (all modules), BIG-IP Next SPK (cloud-native service proxy), BIG-IP Next CNF (containerized network functions), and BIG-IP Next for Kubernetes.

RemediationAI

Apply vendor-supplied patches per F5 Security Advisory K000158082 (https://my.f5.com/manage/s/article/K000158082), which provides version-specific hotfixes and upgrade paths for BIG-IP classic, BIG-IP Next SPK, CNF, and Kubernetes editions. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: enable hardware crypto acceleration by setting crypto.hwacceleration to enabled on supported physical platforms (requires compatible hardware and system reboot, verify QAT device availability first), or migrate Virtual Edition workloads to hardware platforms with QAT support (requires procurement and service migration). For VE deployments where hardware upgrade is not possible, implement rate limiting and connection throttling on SSL virtual servers to reduce TMM crash frequency (degrades legitimate traffic performance under load). Deploy BIG-IP in high-availability pairs with connection mirroring to maintain service continuity during TMM restarts (doubles infrastructure cost, adds synchronization overhead). None of these workarounds eliminate the vulnerability; patching remains the definitive remediation.