# CVE-2026-41956: F5 BIG-IP stack overflow in Traffic Management Microkernel

Source: https://junglewise.ai/threats/cve-2026-41956-f5-big-ip-stack-overflow-in-traffic-management-microkernel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-41956 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in F5 BIG-IP networking devices can allow an attacker to crash the system's core traffic processing engine. This affects devices configured to handle UDP traffic with specific classification profiles, potentially leading to a complete disruption of network services. Successful exploitation results in a denial-of-service condition, impacting business operations and connectivity.

Technologies: [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip), [F5 Big-Ip Access Policy Manager](https://junglewise.ai/threats/technologies/big-ip-access-policy-manager), [F5 Big-Ip Advanced Firewall Manager](https://junglewise.ai/threats/technologies/big-ip-advanced-firewall-manager), [F5 Big-Ip Local Traffic Manager](https://junglewise.ai/threats/technologies/big-ip-local-traffic-manager). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-41956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41956 being exploited in the wild.

**How severe is CVE-2026-41956?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP Refer to K000158038 for specific version status; EoTS versions not evaluated.; F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; and 2 more.

**Is there a fix for CVE-2026-41956?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41956 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41956?** Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the F5 Traffic Management Microkernel (TMM). The vulnerability is triggered when a classification profile is configured on a UDP virtual server and processes specific, undisclosed requests. An unauthenticated remote attacker can exploit this by sending malicious UDP packets to the affected virtual server, causing the TMM to terminate and resulting in a denial-of-service (DoS). The issue affects multiple BIG-IP modules including LTM, AFM, and APM across versions 16.x and 17.x, as well as BIG-IP Next products. F5 has provided mitigation and advisory information in article K000158038.

## Affected products

- F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Next Cloud-Native Network Functions 1.4.0, 2.0.0 - 2.0.2
- F5 BIG-IP Next for Kubernetes 2.0.0

## Timeline

- 2026-05-13: advisory: Initial advisory published by F5

## References

- [https://my.f5.com/manage/s/article/K000158038](https://my.f5.com/manage/s/article/K000158038)

## Related threats

- [F5 BIG-IP privilege escalation in TMUI](https://junglewise.ai/threats/cve-2026-66842-f5-big-ip-privilege-escalation-in-tmui)
- [F5 BIG-IP Configuration utility error message spoofing](https://junglewise.ai/threats/cve-2026-63020-f5-big-ip-configuration-utility-error-message-spoofing)
- [F5 BIG-IP denial of service in HTTP/2 profile memory management](https://junglewise.ai/threats/cve-2026-59762-f5-big-ip-denial-of-service-in-http-2-profile-memory-management)
- [F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST](https://junglewise.ai/threats/cve-2026-42937-f5-big-ip-and-big-iq-incorrect-permission-assignment-in-tmsh-and)
- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)