Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated actor may be able to crash BIG-IP’s Traffic Management Microkernel when DNS caching is enabled. The primary impact is service disruption rather than data theft or modification. Internet-facing or business-critical BIG-IP systems using affected configurations warrant prompt review.
Executive priority
Treat as a high-priority availability risk. Rapidly identify affected, externally reachable, or critical BIG-IP systems, then schedule vendor-directed remediation. Escalate systems supporting essential services because a successful trigger could interrupt traffic processing without authentication.
Technical view
CVE-2026-39458 affects specified BIG-IP releases when DNS caching is active, including caching DNS profiles, SSL Orchestrator, or Advanced WAF DoS protection. Undisclosed network traffic can terminate TMM. CVSS 4.0 rates it 8.7: network-accessible, low complexity, no privileges or user interaction, with high availability impact.
Likely exposure
Potential exposure exists where BIG-IP 21.1.0, 21.0.0, 17.5.0, 17.1.0, or 16.1.0 uses DNS caching. Actual exposure depends on configuration and vendor version guidance. End-of-Technical-Support releases were not evaluated, so their status remains uncertain.
Exploitation context
The source bundle does not establish active exploitation, and the CVE is not listed as CISA KEV. Technical trigger details are undisclosed. Risk nevertheless remains material because the documented condition is remotely reachable, unauthenticated, low complexity, and capable of causing high availability impact.
Researcher notes
The assigned weakness is CWE-824. Available information does not disclose the triggering traffic or confirm exploitability beyond F5’s termination statement. Focus defensive research on configuration reachability, precise build status, crash telemetry, and vendor guidance. Do not infer safety for unsupported releases because F5 did not evaluate EoTS versions.
Mitigation direction
- Review F5 advisory K000160945 for affected builds, fixed releases, and vendor-approved mitigations.
- Prioritize upgrades for exposed or business-critical BIG-IP systems using DNS caching.
- Where operationally acceptable, assess disabling unnecessary DNS caching until remediation is completed.
- Apply normal change controls and availability safeguards before modifying production traffic infrastructure.
Validation and detection
- Inventory BIG-IP versions and identify systems with DNS caching enabled.
- Check DNS profiles, SSL Orchestrator, and Advanced WAF DoS protection configurations.
- Compare each deployed build with F5 advisory K000160945.
- Review monitoring for unexplained TMM terminations or restarts associated with DNS traffic.
- After remediation, confirm expected traffic handling and continued TMM stability.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-824: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-39458 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——f5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6f5Vulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://my.f5.com/manage/s/article/K000160945CVE reference, f5 · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Access of Uninitialized Pointer
Access of Uninitialized Pointer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.