F5 security advisories, May 2026

Every F5 security advisory published in May 2026, from F5 SIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 53
Critical: 2
High: 37
In CISA KEV: 0
CVEs: 53

F5 advisories published in May 2026

May 22, 2026
Critical [CVE-2026-9256] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
Critical9.2
May 19, 2026
Critical [CVE-2026-8711] NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch operation from NGINX JavaScript
Critical9.2
May 13, 2026
High [CVE-2026-42946] NGINX: vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data
High8.3
May 13, 2026
High [CVE-2026-42945] NGINX ngx_http_rewrite_module vulnerability
High8.1
May 13, 2026
High [CVE-2026-42937] Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST
High7.1
May 13, 2026
High [CVE-2026-42930] When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system
High8.5
May 13, 2026
High [CVE-2026-42924] F5: authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation
High8.5
May 13, 2026
High [CVE-2026-42920] F5: When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-42919] vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges
High7.1
May 13, 2026
High [CVE-2026-42781] F5: When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization
High7.1
May 13, 2026
High [CVE-2026-42409] F5: When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate
High8.7
May 13, 2026
High [CVE-2026-42406] vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands
High8.5
May 13, 2026
High [CVE-2026-41959] Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST
High7.1
May 13, 2026
High [CVE-2026-41957] authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility
High8.7
May 13, 2026
High [CVE-2026-41956] F5: When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-41953] vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation
High8.5
May 13, 2026
High [CVE-2026-41227] F5: On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate
High8.7
May 13, 2026
High [CVE-2026-41225] F5: vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands
High8.6
May 13, 2026
High [CVE-2026-41219] improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file
High7.1
May 13, 2026
High [CVE-2026-41218] When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-41217] vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges
High8.3
May 13, 2026
High [CVE-2026-40699] F5: vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information
High7.1
May 13, 2026
High [CVE-2026-40698] vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation
High8.5
May 13, 2026
High [CVE-2026-40631] F5: authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation
High8.5
May 13, 2026
High [CVE-2026-40629] F5: When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections
High8.7
May 13, 2026
High [CVE-2026-40618] When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-40462] F5: Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information
High7.1
May 13, 2026
High [CVE-2026-40423] F5: When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-40067] When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate
High8.7
May 13, 2026
High [CVE-2026-40061] When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges
High8.5
May 13, 2026
High [CVE-2026-40060] When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate
High8.7
May 13, 2026
High [CVE-2026-39459] F5: vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands
High8.6
May 13, 2026
High [CVE-2026-39458] When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
High8.7
May 13, 2026
High [CVE-2026-39455] When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors
High8.7
May 13, 2026
High [CVE-2026-35062] F5: authenticated iControl SOAP user may be able to obtain information of other accounts
High7.1
May 13, 2026
High [CVE-2026-34176] F5: When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST…
High8.5
May 13, 2026
High [CVE-2026-32673] vulnerability exists in BIG-IP scripted monitors that may
High8.5
May 13, 2026
High [CVE-2026-32643] vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the…
High8.5
May 13, 2026
High [CVE-2026-20916] BIG-IQ: authenticated iControl REST user with low privileges
High7.2
May 13, 2026
Medium [CVE-2026-42934] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module
Medium6.3
May 13, 2026
Medium [CVE-2026-42926] When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer
Medium6.3
May 13, 2026
Medium [CVE-2026-42780] directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files
Medium6.9
May 13, 2026
Medium [CVE-2026-42408] When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information
Medium6.7
May 13, 2026
Medium [CVE-2026-42063] F5: vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files
Medium6.9
May 13, 2026
Medium [CVE-2026-42058] authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names
Medium5.3
May 13, 2026
Medium [CVE-2026-41954] F5: Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information
Medium6.9
May 13, 2026
Medium [CVE-2026-40703] cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility
Medium5.3
May 13, 2026
Medium [CVE-2026-40701] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver
Medium6.3
May 13, 2026
Medium [CVE-2026-40460] When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting
Medium6.9
May 13, 2026
Medium [CVE-2026-40435] F5: When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses
Medium6.9
May 13, 2026
Medium [CVE-2026-34019] F5: When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic
Medium6.3
May 13, 2026
Medium [CVE-2026-28758] When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the…
Medium6.7
May 13, 2026
Medium [CVE-2026-24464] F5: When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may
Medium6.9

Get an email when F5 publishes the next one.

See F5's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about F5

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.