Which versions of F5 BIG-IP are affected by EUVD-2026-29990?

F5 BIG-IP platforms are vulnerable to unauthenticated remote denial-of-service attacks that can crash the Traffic Management Microkernel, disrupting load balancing and application availability across…. A patch is available.

How to fix or mitigate EUVD-2026-29990?

Within 24 hours: Identify all F5 BIG-IP instances in your environment and verify which have classification profiles enabled using F5 advisory K000158038. Within 7 days: Apply the vendor-released patch from F5 advisory K000158038 to all affected systems, prioritizing production load balancers and Kubernetes environments. Within 30 days: Validate patch deployment across all BIG-IP platforms and confirm TMM stability through monitoring; document any instances that cannot be immediately patched and implement network-level mitigations (see compensating controls).

F5 BIG-IP EUVD-2026-29990

Q: What is the CVSS score of EUVD-2026-29990?

EUVD-2026-29990 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41956 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-13 f5

GHSA-7vhg-fvrv-7x3q

Stack Overflow Buffer Overflow Big Ip Big Ip Next Cnf Big Ip Next For Kubernetes

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:47 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) by sending specially crafted UDP requests to virtual servers with classification profiles enabled. The vulnerability affects BIG-IP, BIG-IP Next CNF, and BIG-IP Next for Kubernetes platforms. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE. Vendor-released patch available per F5 advisory K000158038.

Technical ContextAI

F5 BIG-IP's Traffic Management Microkernel (TMM) is the core data plane component responsible for processing and forwarding network traffic through virtual servers. This vulnerability stems from a stack-based buffer overflow (CWE-121) in TMM's handling of UDP traffic when classification profiles are applied. Classification profiles analyze traffic patterns for application identification and policy enforcement. The flaw occurs during parsing or processing of undisclosed UDP request patterns, causing a write operation to exceed stack boundaries and triggering TMM process termination. Affected products span the traditional BIG-IP appliances (cpe:2.3:a:f5:big-ip), container-native BIG-IP Next CNF (Cloud-Native Function), and BIG-IP Next for Kubernetes deployments, indicating the vulnerable code exists across multiple F5 product architectures.

RemediationAI

Apply vendor-released patches per F5 Security Advisory K000158038 (https://my.f5.com/manage/s/article/K000158038), which provides specific fixed versions for each affected product line. Patching is the primary remediation and should be prioritized for internet-facing UDP virtual servers with classification profiles. As a temporary mitigation for systems that cannot be immediately patched, administrators can disable classification profiles on UDP virtual servers, though this removes traffic analysis capabilities and may impact application visibility and policy enforcement. Alternatively, restrict UDP virtual server access to trusted networks using firewall rules or BIG-IP AFM policies, trading off service availability for security. For critical UDP services like DNS or SIP, consider moving to non-affected load balancers temporarily or implementing redundant BIG-IP instances with staggered patching schedules to maintain availability during remediation. Review F5 advisory for product-specific upgrade paths and compatibility considerations before applying patches to production systems.