Is CVE-2026-40423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40423 being exploited in the wild.

How severe is CVE-2026-40423?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

F5 BIG-IP All versions with SIP profiles configured (excluding EoTS); F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Application Security Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; and 1 more.

Is there a fix for CVE-2026-40423?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40423 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40423?

Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40423: F5 BIG-IP denial of service in TMM SIP profile processing

CVE-2026-40423 · Severity: high · CVSS 7.5 · Published 2026-05-13

F5 BIG-IP devices, which manage and secure enterprise network traffic, are vulnerable to a denial-of-service attack when processing specific Session Initiation Protocol (SIP) traffic. An attacker can send specially crafted network traffic to a virtual server, causing the core traffic management component to crash. This results in a complete interruption of network services and application availability managed by the affected BIG-IP system.

Technologies: F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager. Vendors: F5.

Quick answers

Is CVE-2026-40423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40423 being exploited in the wild.
How severe is CVE-2026-40423?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: F5 BIG-IP All versions with SIP profiles configured (excluding EoTS); F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Application Security Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; and 1 more.
Is there a fix for CVE-2026-40423?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40423 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40423?: Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as a resource management issue (CWE-770) within the Traffic Management Microkernel (TMM) of F5 BIG-IP. When a virtual server is configured with a SIP (Session Initiation Protocol) profile, it fails to properly handle specific, undisclosed network traffic. A remote, unauthenticated attacker can exploit this by sending malicious SIP packets, leading to a TMM crash and subsequent denial of service. The vulnerability affects multiple BIG-IP modules including LTM, AFM, and APM across versions 16.1.x, 17.5.x, and 21.0.0. F5 has released a vendor advisory (K000161023) detailing affected versions and potential mitigations.

Affected products

F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Application Security Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0

Timeline

2026-05-13: advisory: Initial publication of the vulnerability advisory.

References

https://my.f5.com/manage/s/article/K000161023

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.