Which versions of BIG-IP PEM are affected by CVE-2026-41218?

CVE-2026-41218 is a remote denial-of-service vulnerability in F5 BIG-IP Policy Enforcement Manager that allows unauthenticated attackers to crash the Traffic Management Microkernel through specially…. A patch is available.

How to fix or mitigate CVE-2026-41218?

Within 24 hours: Identify all F5 BIG-IP systems running PEM with iRule commands (CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, urlcatquery) enabled via configuration audit. Within 7 days: Apply vendor patch K000160875 per F5 advisory to all affected BIG-IP PEM instances, staging in non-production first. Within 30 days: Validate patch deployment across all production systems and confirm TMM stability post-update through traffic baseline testing.

BIG-IP PEM CVE-2026-41218

Q: What is the CVSS score of CVE-2026-41218?

CVE-2026-41218 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29984 HIGH

Use After Free (CWE-416)

2026-05-13 f5

GHSA-65gg-93p6-xmj9

Information Disclosure Use After Free Memory Corruption Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:46 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) via undisclosed traffic patterns when PEM-specific iRules are configured on a virtual server. The vulnerability is a use-after-free memory corruption issue (CWE-416) affecting CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and urlcatquery iRule commands. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates straightforward remote exploitation with high availability impact. EPSS data not provided, but F5 has released a vendor patch (K000160875). No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

F5 BIG-IP Policy Enforcement Manager (PEM) is an application-layer traffic management and policy enforcement solution integrated into BIG-IP ADCs. The vulnerability exists in the Traffic Management Microkernel (TMM), the core packet processing engine handling iRules execution. PEM iRules extend BIG-IP's programmability with policy-specific commands for classification, subscriber management, and URL categorization. The CWE-416 classification indicates a use-after-free condition where TMM attempts to access freed memory during processing of specific traffic patterns when PEM iRule commands (CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, or urlcatquery) are active. Use-after-free vulnerabilities typically arise from improper object lifecycle management in memory, where pointers to deallocated memory regions remain accessible, leading to crashes or potentially exploitable conditions when dereferenced. The CPE string cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:* indicates broad version coverage across BIG-IP product lines, though F5 notes that End of Technical Support versions were not evaluated.

RemediationAI

Apply the vendor-released patches detailed in F5 Security Advisory K000160875 available at https://my.f5.com/manage/s/article/K000160875, which provides version-specific upgrade paths and hotfix availability for supported BIG-IP releases. F5 typically releases Engineering Hotfixes (EHF) for current maintenance branches followed by incorporation into subsequent major releases, so consult the advisory for your specific version's remediation path. If immediate patching is not feasible, consider temporary compensating controls: disable or remove PEM iRules containing CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, or urlcatquery commands from production virtual servers (restores normal BIG-IP ADC functionality but eliminates PEM policy enforcement capabilities, potentially impacting subscriber management or traffic classification business requirements); implement upstream rate limiting or traffic filtering to reduce exposure to scanning/probing attempts (provides limited protection since triggering traffic patterns are undisclosed); or move PEM-enabled virtual servers behind additional network segmentation with stricter access controls (reduces attack surface but adds infrastructure complexity and potential latency). Note that workarounds eliminating PEM iRule functionality may require policy enforcement logic to be re-implemented at application layer or alternative enforcement points in the network architecture.