F5 BIG-IP CVE-2026-42781

Embedded Packet Velocity Acceleration (ePVA) must be explicitly enabled in BIG-IP configuration - this is not a default feature. Attacker must have adjacent network access (AV:A): direct connection to the same ethernet segment, VLAN, or local network as the BIG-IP management or data plane. No authentication, special privileges, or user interaction required. Exploitation is feasible only in network topologies where untrusted or compromised internal hosts can reach the BIG-IP; air-gapped or DMZ-segmented deployments significantly reduce practical risk.

CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U) indicates adjacent network attack vector with low complexity and no privileges or user interaction required - realistically limited to local network segments. EPSS score unavailable, preventing probabilistic exploitation assessment. KEV status not provided; no public POC identified at time of analysis. Real-world risk depends critically on network topology: denial of service via ePVA exhaustion is severe only if the target environment relies on BIG-IP for critical load balancing or traffic management and the attacker has local network access (VLAN, same subnet, or direct connection). The 'undisclosed' nature of the triggering traffic suggests the vendor has not published technical details, limiting independent verification. High-availability systems with redundant BIG-IP instances and local network segmentation constraints reduce practical impact.

An attacker with adjacent network access (same L2 segment or VLAN as BIG-IP) sends a sequence of specially-crafted ethernet frames targeting the ePVA subsystem. These frames trigger unbounded resource allocation or iteration in ePVA and TMM, exhausting CPU, memory, or internal buffers. Within seconds to minutes, BIG-IP becomes unresponsive to legitimate traffic, causing service disruption for applications depending on the load balancer.