Skip to content
OpenAdvisories
High · 7.5 CVE-2026-40060 EUVD-2026-29969GHSA-p3wj-9p5j-v2f9

BIG-IP Advanced WAF and ASM vulnerability

Published May 13, 2026 · Updated May 13, 2026 · Assigned by f5

Description

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

VendorProductAffectedFixed
F5 BIG-IP 21.0.0 – < 21.0.0.1, 17.5.0 – < 17.5.1.4, 17.1.0 – < 17.1.3.1, 16.1.0 21.0.0.1

Advisories 2

References