CVE-2026-39455: BIG-IP Configuration Utility DoS Vulnerability

CVE-2026-39455 Overview

CVE-2026-39455 is a denial of service vulnerability affecting F5 BIG-IP devices when the Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication. Undisclosed network traffic can cause the httpd process to exhaust available file descriptors. The flaw maps to [CWE-772: Missing Release of Resource after Effective Lifetime]. Once descriptors are depleted, the management interface becomes unresponsive, disrupting administrative access to the appliance. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Remote unauthenticated attackers can exhaust file descriptors in the httpd process, rendering the BIG-IP Configuration utility unavailable for administration.

Affected Products

F5 BIG-IP (Configuration utility with LDAP authentication enabled)
Refer to the F5 Security Advisory K000160874 for the complete list of impacted versions
Software versions that have reached End of Technical Support are not evaluated

Discovery Timeline

2026-05-13 - CVE-2026-39455 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-39455

Vulnerability Analysis

The vulnerability resides in the BIG-IP Configuration utility, the web-based administrative interface served by the httpd process. When the utility is configured to authenticate users via Lightweight Directory Access Protocol (LDAP), specific undisclosed traffic patterns trigger improper resource cleanup. File descriptors associated with LDAP authentication requests are not released, accumulating until the process reaches its descriptor limit.

Once the limit is reached, httpd can no longer accept new connections or open files. The management interface becomes unavailable, blocking legitimate administrators from configuring policies, viewing telemetry, or applying updates. Data plane traffic forwarded by BIG-IP is not directly impacted, but loss of management access prevents incident response actions.

Root Cause

The issue is classified as [CWE-772: Missing Release of Resource after Effective Lifetime]. The LDAP authentication code path within the Configuration utility fails to close file descriptors associated with certain request states. Repeated requests amplify the leak until the per-process descriptor table is exhausted.

Attack Vector

The attack vector is network-based, requires no privileges, and requires no user interaction. An unauthenticated remote attacker who can reach the BIG-IP Configuration utility over the management network can send the triggering traffic. Because F5 has not disclosed the specific request pattern, defenders should restrict management plane exposure as a primary control.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the F5 Security Advisory K000160874 for vendor technical details.

Detection Methods for CVE-2026-39455

Indicators of Compromise

Sudden unresponsiveness of the BIG-IP Configuration utility (TMUI) on TCP/443 of the management interface
httpd error logs containing "Too many open files" or EMFILE messages
Elevated count of open file descriptors for httpd processes approaching the configured ulimit
Spikes in inbound connections to the management interface from unexpected sources

Detection Strategies

Monitor /var/log/httpd/httpd_errors and /var/log/ltm for descriptor exhaustion errors
Baseline open file descriptor counts using lsof -p $(pgrep httpd) and alert on sustained growth
Inspect LDAP authentication request rates and correlate with httpd resource consumption
Track management interface availability with synthetic health checks against the Configuration utility login page

Monitoring Recommendations

Forward BIG-IP httpd and audit logs to a centralized SIEM for correlation
Alert when httpd file descriptor usage exceeds 80 percent of the configured limit
Monitor for repeated failed or partial LDAP authentication attempts from a single source
Track process restarts of httpd on BIG-IP appliances as a potential post-incident signal

How to Mitigate CVE-2026-39455

Immediate Actions Required

Apply the fixed software versions identified in F5 Security Advisory K000160874
Restrict access to the BIG-IP Configuration utility to trusted management networks only
Verify that the management interface is not reachable from untrusted networks or the public internet
Review LDAP authentication configuration and audit account usage against the Configuration utility

Patch Information

F5 has published remediation guidance in F5 Security Advisory K000160874. Administrators should identify their installed BIG-IP version and upgrade to a fixed release listed in the advisory. Versions that have reached End of Technical Support are not evaluated and should be replaced with supported releases.

Workarounds

Switch the Configuration utility to a non-LDAP authentication method, such as local accounts or TACACS+, until patching is complete
Enforce strict source IP allowlists on the management interface using tmsh packet filters or upstream firewall rules
Place the BIG-IP management interface behind a dedicated management VLAN with no inbound routing from production networks
Monitor and restart httpd proactively if descriptor usage trends toward exhaustion

bash

# Restrict access to the BIG-IP Configuration utility to a trusted management subnet
tmsh modify sys httpd allow replace-all-with { 10.10.0.0/24 127.0.0.0/8 }
tmsh save sys config

# Verify current open file descriptor usage for httpd
lsof -p $(pgrep -d, httpd) | wc -l