CVE-2026-40060 F5 CVE debrief

Who should care

Security teams and administrators responsible for BIG-IP Advanced WAF or ASM security policy configurations should be aware of this vulnerability. The vulnerability's HIGH severity and potential impact on service availability make it a priority for organizations using affected versions.

Technical summary

The vulnerability occurs when a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server. Undisclosed requests can cause the bd process to terminate, potentially leading to service disruption. The affected products include BIG-IP Application Security Manager and BIG-IP Advanced Web Application Firewall. Specific CPE criteria and version ranges are provided in the source item metadata.

Defensive priority

Apply mitigations and updates as recommended by the vendor. Review and update BIG-IP Advanced WAF or ASM security policy configurations to minimize potential impact.

Recommended defensive actions

• Review BIG-IP Advanced WAF or ASM security policy configurations for potential vulnerabilities.
• Apply vendor-recommended mitigations and updates.
• Monitor for undisclosed requests that could cause bd process termination.
• Consider compensating controls to minimize potential impact.
• Update inventory and track affected systems for remediation.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. The source item metadata includes CPE criteria and version ranges for affected products. Vendor advisory and mitigation information are available.

Official resources