CVE-2026-22548

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22548", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-01-21T21:33:16.394Z", "datePublished": "2026-02-04T15:02:05.724Z", "dateUpdated": "2026-02-04T16:04:59.113Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["BIG-IP ASM/Adv WAF"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "21.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "unaffected", "version": "17.5.0", "versionType": "custom"}, {"lessThan": "17.1.3", "status": "affected", "version": "17.1.0", "versionType": "custom"}, {"lessThan": "*", "status": "unaffected", "version": "16.1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "F5"}], "datePublic": "2026-02-04T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the </span><strong>bd</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;process to terminate.</span>&nbsp; Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd\u00a0process to terminate.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-02-04T15:02:05.724Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000158072"}], "source": {"discovery": "INTERNAL"}, "title": "BIG-IP Advanced WAF and ASM vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:04:03.254466Z", "id": "CVE-2026-22548", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:04:59.113Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:04:03.254466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:04:28.708Z"}}], "cna": {"title": "BIG-IP Advanced WAF and ASM vulnerability", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "F5"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["BIG-IP ASM/Adv WAF"], "product": "BIG-IP", "versions": [{"status": "unaffected", "version": "21.0.0", "lessThan": "*", "versionType": "custom"}, {"status": "unaffected", "version": "17.5.0", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "17.1.0", "lessThan": "17.1.3", "versionType": "custom"}, {"status": "unaffected", "version": "16.1.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-04T15:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K000158072", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "F5 SIRTBot v1.0"}, "descriptions": [{"lang": "en", "value": "When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd\u00a0process to terminate.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the </span><strong>bd</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;process to terminate.</span>&nbsp; Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-02-04T15:02:05.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22548", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:04:59.113Z", "dateReserved": "2026-01-21T21:33:16.394Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2026-02-04T15:02:05.724Z", "assignerShortName": "f5"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["BIG-IP ASM/Adv WAF"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "21.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "unaffected", "version": "17.5.0", "versionType": "custom"}, {"lessThan": "17.1.3", "status": "affected", "version": "17.1.0", "versionType": "custom"}, {"lessThan": "*", "status": "unaffected", "version": "16.1.0", "versionType": "custom"}]}], "source": "f5sirt@f5.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B24E3BE-8A62-4819-B63C-01EE10E6160F", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF0F0A9D-1B7E-4271-B309-64399AC7DD89", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd\u00a0process to terminate.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "Cuando una pol\u00edtica de seguridad BIG-IP Advanced WAF o ASM est\u00e1 configurada en un servidor virtual, solicitudes no reveladas junto con condiciones fuera del control del atacante pueden causar la terminaci\u00f3n del proceso bd. Nota: Las versiones de software que han alcanzado el Fin de Soporte T\u00e9cnico (EoTS) no se eval\u00faan."}], "id": "CVE-2026-22548", "lastModified": "2026-06-17T10:20:03.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "f5sirt@f5.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f5sirt@f5.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22548", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T16:04:03.254466Z", "version": "2.0.3"}}]}, "published": "2026-02-04T15:16:14.913", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K000158072"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "f5sirt@f5.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:02:43.009624+00:00", "value": {"mitigation_remediation": ["Apply the latest F5 BIG\u2011IP firmware patch that addresses the bd process termination flaw.", "If a patch is not yet available, consider disabling the Advanced WAF or ASM policy on the vulnerable virtual servers or moving the traffic off the affected device until remediation is available.", "Restrict inbound traffic to the virtual servers to trusted IP ranges to reduce exposure to potential trigger requests.", "Monitor system logs for unexpected bd process restarts and review any anomalous request patterns that could indicate exploitation attempts."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service via BIG\u2011IP Advanced WAF or ASM process crash"}, "threat_synthesis": {"affected_systems": "F5 BIG\u2011IP Advanced Web Application Firewall and F5 BIG\u2011IP Application Security Manager are impacted. The advisory does not list specific firmware versions, but the issue applies to any active release in which the advanced WAF or ASM policy is enabled on a virtual server. End of Technical Support versions are excluded from assessment.", "description_and_impact": "A misconfiguration in BIG\u2011IP Advanced WAF or ASM security policies can cause the bd process to terminate unexpectedly when the system receives certain undocumented requests combined with conditions outside the attacker\u2019s direct control. The resulting crash leads to a denial of service, disrupting the availability of the protected application or virtual server. The vulnerability is a concurrency issue (CWE\u2011362) and does not directly affect confidentiality or integrity. The impact is limited to the affected virtual instance and the control plane managing it.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity. The EPSS probability is reported as less than 1\u202f%, implying a very low expected exploitation rate at present, but it remains plausible once the vulnerability is known for public exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker would need to craft or trigger the undocumented requests against a configured virtual server, which is possible from any network that can reach the F5 device. The crash would deplete the affected service, but no code execution or data exfiltration is possible based on the current description."}}}}, "created": "2026-02-04T21:17:49.530415+00:00", "updated": "2026-04-18T14:15:04.114857+00:00", "vendors": ["f5", "f5$PRODUCT$big-ip"]}