CVEs published in May 2026

CVE-2026-40698High

vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation

CVE-2026-40631High

F5: authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation

CVE-2026-40629High

F5: When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections

CVE-2026-40618High

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate

CVE-2026-40462High

F5: Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information

CVE-2026-40435Medium

F5: When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses

CVE-2026-40423High

F5: When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate

CVE-2026-40067High

When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate

CVE-2026-40061High

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges

CVE-2026-40060High

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate

CVE-2026-39459High

F5: vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands

CVE-2026-39458High

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate

CVE-2026-39455High

When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors

CVE-2026-35062High

F5: authenticated iControl SOAP user may be able to obtain information of other accounts

CVE-2026-34176High

F5: When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST…

CVE-2026-34019Medium

F5: When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic

CVE-2026-32673High

vulnerability exists in BIG-IP scripted monitors that may

CVE-2026-32643High

vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the…

CVE-2026-28758Medium

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the…

CVE-2026-24464Medium

F5: When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may

CVE-2026-20916High

BIG-IQ: authenticated iControl REST user with low privileges

CVE-2026-0247High

Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities

CVE-2026-0246High

Prisma Access Agent: Local Privilege Escalation Vulnerability

CVE-2026-0242High

Trust Protection Foundation: SQL Injection Vulnerability

CVE-2026-0241High

Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities

CVE-2026-44431Critical

Information disclosure via cross-origin redirects forwarding sensitive headers

CVE-2026-44432High

Denial of Service due to excessive HTTP response decompression

CVE-2026-40460Critical

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting

CVE-2026-42945Critical

NGINX ngx_http_rewrite_module vulnerability

CVE-2026-46300HighCISA KEV

Linux Kernel Missing Initialization of a Variable Vulnerability

CVE-2026-7168Critical

Information disclosure via incorrect Proxy-Authorization header reuse

CVE-2024-36899High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-44871High

AOS-10: Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems

CVE-2026-44874Medium

AOS-10: vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system

CVE-2026-44873Medium

AOS-8: session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled

CVE-2026-44872High

AOS-10: command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44870High

AOS-10: Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems

CVE-2026-44869High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44868High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44867High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44866High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44865High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44864High

AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol

CVE-2026-44863High

AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol

CVE-2026-44862High

AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol

CVE-2026-44861High

AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol

CVE-2026-44860High

AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol

CVE-2026-44859High

AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems

CVE-2026-44858High

AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems

CVE-2026-44857High

AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems

CVE-2026-44856High

AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems

CVE-2026-44855High

AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems

CVE-2026-44854High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44853High

AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems

CVE-2026-44852High

AOS-10: authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface

CVE-2026-23827High

AOS-10: heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution

CVE-2026-23826High

AOS-8: vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition

CVE-2026-23825High

AOS-10: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems

CVE-2026-23824High

AOS-10: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems

CVE-2026-23823High

AOS-10: vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection

CVE-2026-23822Medium

AOS-8: vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition

CVE-2026-23821High

AOS-10: vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions

CVE-2026-23820High

AOS-10: vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment

CVE-2026-23819High

AOS-10: vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network

CVE-2026-41097Medium

Secure Boot Security Feature Bypass Vulnerability

CVE-2026-40413High

Windows TCP/IP Denial of Service Vulnerability

CVE-2026-40403High

Windows Graphics Component Remote Code Execution Vulnerability

CVE-2026-40402Critical

Windows Hyper-V Elevation of Privilege Vulnerability

CVE-2026-40401High

Windows TCP/IP Denial of Service Vulnerability

CVE-2026-40398High

Windows Remote Desktop Services Elevation of Privilege Vulnerability

CVE-2026-32209Medium

Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability

CVE-2026-40397High

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2026-40382High

Windows Telephony Service Elevation of Privilege Vulnerability

CVE-2026-40369High

Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-40370High

SQL Server Remote Code Execution Vulnerability

CVE-2026-40367High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-40365High

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-40357High

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-34341High

Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability

CVE-2026-34340High

Windows Projected File System Elevation of Privilege Vulnerability

CVE-2026-34339Medium

Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

CVE-2026-34338High

Windows Telephony Service Elevation of Privilege Vulnerability

CVE-2026-34337High

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2026-34336High

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2026-34334High

Windows TCP/IP Elevation of Privilege Vulnerability

CVE-2026-34332High

Windows Kernel-Mode Driver Remote Code Execution Vulnerability

CVE-2026-33838High

Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2026-33837High

Windows TCP/IP Local Elevation of Privilege Vulnerability

CVE-2026-33835High

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2026-33112High

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-33110High

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-42896High

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2026-42825High

Windows Telephony Service Elevation of Privilege Vulnerability

CVE-2026-32170Medium

Windows Rich Text Edit Elevation of Privilege Vulnerability

CVE-2026-32161High

Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability

CVE-2026-41096Critical

Windows DNS Client Remote Code Execution Vulnerability

CVE-2026-41095High

Data Deduplication Elevation of Privilege Vulnerability

CVE-2026-41089Critical

Windows Netlogon Remote Code Execution Vulnerability

CVE-2026-41088High

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-40415High

Windows TCP/IP Remote Code Execution Vulnerability