F5 BIG-IP CVE-2026-40629

Exploitation requires that the target BIG-IP virtual server has SSL profiles explicitly configured for client-side SSL/TLS termination or SSL bridging. Default BIG-IP installations without SSL profiles configured are not vulnerable. The virtual server must be network-accessible to the attacker (typically internet-facing for maximum impact, though internal attackers could target internal virtual servers). No authentication, user interaction, or privileged access is required per the CVSS vector (PR:N/UI:N). The specific 'undisclosed traffic' pattern has not been publicly documented by F5, which may limit script-kiddie exploitation but will not prevent motivated attackers from reverse-engineering patch binaries or rediscovering the trigger independently. Exploitation is limited to causing denial of service against new connection attempts-existing established connections and data confidentiality/integrity are not directly impacted per the CVSS vector (C:N/I:N).

The CVSS score of 7.5 (High) reflects maximum availability impact (A:H) with network accessibility and no authentication required (AV:N/PR:N), representing legitimate concern for internet-facing BIG-IP deployments. However, several factors moderate real-world risk: No EPSS data is provided, CISA KEV status is absent suggesting no confirmed active exploitation, and no public proof-of-concept is identified in available intelligence. The attack requires only network access to SSL-enabled virtual servers, which is common for production ADC deployments, but the CVSS complexity rating (AC:L) may be misleading since the specific 'undisclosed traffic' pattern required is not documented. The SSVC framework would rate this as having high technical impact (DoS of critical infrastructure) but unknown exploitation status. Priority depends heavily on whether BIG-IP virtual servers are internet-exposed and actively processing SSL traffic-for organizations using BIG-IP as edge load balancers or WAF, this is a genuine operational risk requiring prompt patching during maintenance windows. For internal-only deployments with restricted network access, risk is substantially lower. The availability of vendor patches elevates this from monitoring to action status.

An attacker identifies an internet-facing F5 BIG-IP virtual server handling SSL/TLS traffic through service enumeration or published application architecture. They craft or replay specific undisclosed traffic patterns that trigger uncontrolled resource allocation in the SSL profile processing logic. As the virtual server exhausts available connection resources without proper throttling, legitimate clients receive connection timeouts or refusals, disrupting business-critical applications relying on BIG-IP for load balancing and SSL offload. The attack requires only network reachability with no authentication, credentials, or user interaction, allowing sustained or intermittent denial of service from any internet location until patches are applied.