Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
3804 articles · 153134 vulns · 38/41 feeds (7d)
← Back to list
7.5
CVE-2026-40618EXPLOITEDPATCHED
f5 · big-ip

BIG-IP SSL/TLS vulnerability

Description

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Products

VendorProductVersions
f5big-ip21.0.0, 17.5.0, 17.1.0, 16.1.0, 2.0.0, 1.7.0, 2.0.0, 1.1.0, 2.0.0

References

  • https://my.f5.com/manage/s/article/K000158082(vendor-advisory, patch)

Related News (1 articles)

Tier C
VulDB5h ago
CVE-2026-40618 | F5 BIG-IP prior 17.1.3.1/17.1.5.4/21.0.0.1 Traffic Management Microkernel buffer size (K000158082)
→ No new info (linked only)
CVSS 3.17.5 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
21.1.021.0.0.117.1.5.417.1.3.1*2.2.0
CWECWE-131
PublishedMay 13, 2026
Last enriched5h agov2
Tags
CVE-2026-40618
Trending Score55
Source articles1
Independent1
Info Completeness9/14
Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-42945EXP
NGINX ngx_http_rewrite_module vulnerability
Trending: 74
MEDIUMCVE-2026-40701EXP
NGINX ngx_http_ssl_module vulnerability
Trending: 58
MEDIUMCVE-2026-42934EXP
NGINX ngx_http_charset_module vulnerability
Trending: 58
HIGHCVE-2026-40629EXP
BIG-IP SSL/TLS vulnerability
Trending: 56
HIGHCVE-2026-40060EXP
BIG-IP Advanced WAF and ASM vulnerability
Trending: 56

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
May 13, 2026
Discovered by ZDM
May 13, 2026
Updated: description, severity, activelyExploited, tags
May 13, 2026
Actively Exploited
May 13, 2026
Patch Available
May 13, 2026

Version History

v2
Last enriched 5h ago
v2Tier C5h ago

Updated severity to CRITICAL, added new description with technical details, and marked the vulnerability as actively exploited.

descriptionseverityactivelyExploitedtags
via VulDB
v15h ago

Initial creation