BIG-IP PEM CVE-2026-41218

Exploitation requires BIG-IP virtual servers configured with Policy Enforcement Manager (PEM) iRules containing specific commands: CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, or the urlcatquery command. Default BIG-IP ADC configurations without PEM module licensing or PEM iRule implementations are NOT vulnerable. The vulnerability is limited to traffic processing paths where these PEM commands actively inspect or classify packets. F5's description of 'undisclosed traffic' indicates specific packet characteristics or protocol patterns trigger the use-after-free, but these triggering conditions are not publicly documented, creating uncertainty for defenders assessing realistic exposure. Remote network access to the virtual server is required (AV:N), but no authentication (PR:N), user interaction (UI:N), or complex attack prerequisites (AC:L) limit exploitation once the triggering traffic pattern is identified or discovered.

Real-world risk is elevated for organizations using BIG-IP PEM with custom iRules in production traffic paths. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates maximum accessibility - remote unauthenticated attackers can exploit this without complex preparation or user interaction. The straightforward attack complexity (AC:L) suggests reliable exploitation once triggering traffic patterns are identified. However, scope is unchanged (S:U) and impact is limited to availability (A:H) with no confidentiality or integrity compromise, reducing this from a critical data breach risk to a service disruption threat. The vulnerability requires specific PEM iRule configurations, meaning default BIG-IP deployments without PEM policy enforcement are NOT vulnerable - this is a crucial scoping factor absent from CVSS alone. F5's cryptic 'undisclosed traffic' phrasing suggests either incomplete root cause analysis or deliberate obfuscation of exploit triggers, creating uncertainty for defenders trying to assess exposure. Without EPSS scoring, we cannot gauge attacker interest, but the lack of CISA KEV listing and public POC suggests exploitation remains theoretical or limited. The use-after-free classification (CWE-416) is concerning because such flaws can sometimes be escalated beyond DoS to code execution, though F5's impact assessment shows only availability compromise. Organizations running BIG-IP PEM with custom iRules in internet-facing configurations should prioritize patching due to the remote unauthenticated attack vector, while those using BIG-IP without PEM features can deprioritize. The availability of vendor patches reduces risk for organizations with active maintenance contracts, but the broad CPE coverage and vague version information complicates asset inventory matching.

An external attacker identifies an internet-facing F5 BIG-IP virtual server implementing subscriber policy enforcement via PEM iRules for traffic classification or URL categorization. Without authentication, the attacker crafts or sends specific traffic patterns (exact nature undisclosed by F5) targeting the PEM iRule processing logic that triggers the use-after-free condition in TMM. The malformed or unexpected traffic causes TMM to terminate, resulting in service disruption for all traffic handled by that BIG-IP instance until TMM restarts, potentially affecting thousands of concurrent sessions for ISP or enterprise traffic management deployments.