CVE-2026-22548
📋 TL;DR
This vulnerability in BIG-IP Advanced WAF or ASM security policies allows attackers to cause the bd process to terminate through specific requests under certain conditions. This affects F5 BIG-IP systems running vulnerable versions with WAF/ASM policies configured. The impact is denial of service rather than data compromise.
💻 Affected Systems
- F5 BIG-IP Advanced WAF
- F5 BIG-IP ASM
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the affected virtual server, disrupting application availability until the bd process restarts automatically or manually.
Likely Case
Intermittent service disruptions as the bd process crashes and restarts, causing temporary application unavailability.
If Mitigated
Minimal impact with proper monitoring and automated process restart mechanisms in place.
🎯 Exploit Status
Requires specific request patterns and conditions beyond attacker's control, making exploitation somewhat unpredictable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000158072 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000158072
Restart Required: Yes
Instructions:
1. Review F5 advisory K000158072 for affected versions. 2. Upgrade to fixed version per F5 documentation. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Disable vulnerable configurations
allTemporarily remove or disable Advanced WAF/ASM security policies from vulnerable virtual servers
# Use F5 TMSH or GUI to modify virtual server configurations
# tmsh modify ltm virtual <vs_name> policies remove { <policy_name> }
🧯 If You Can't Patch
- Implement network segmentation to limit access to vulnerable virtual servers
- Deploy additional monitoring for bd process crashes and implement automated restart scripts
🔍 How to Verify
Check if Vulnerable:
Check if running affected BIG-IP version with WAF/ASM policies configured using 'tmsh show sys software' and review virtual server configurationsCheck Version:
tmsh show sys softwareVerify Fix Applied:
Verify upgraded to fixed version using 'tmsh show sys software' and confirm no bd process crashes occur during testing📡 Detection & Monitoring
Log Indicators:
- bd process termination/crash logs in /var/log/ltm
- Application availability alerts
- Increased process restart events
Network Indicators:
- Unusual request patterns to WAF/ASM protected applications
- Sudden service unavailability
SIEM Query:
source="/var/log/ltm" AND "bd process" AND (terminated OR crashed OR restart)