Loading story…
National cyber authorities in Belgium and Canada warned about CVE-2026-2507, a high-severity denial-of-service (DoS) vulnerability in F5 BIG-IP Traffic Management Microkernel (TMM) affecting BIG-IP AFM and BIG-IP DDoS Hybrid Defender when those modules are provisioned. The issue impacts versions 17.x through 17.5.1.4 and can be triggered remotely over the network by an unauthenticated attacker using undisclosed traffic that can cause TMM to terminate, resulting in service interruption and loss of availability (CVSS 7.5).
Both advisories direct organizations to F5’s vendor bulletin K000160003 and recommend applying the relevant updates with high priority. The Centre for Cybersecurity Belgium additionally advises increasing monitoring/detection for suspicious activity and notes that patching prevents future exploitation but does not remediate any potential prior compromise, and provides incident reporting guidance via its national CERT channel.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-19, Belgium's Centre for Cybersecurity issued a warning that the F5 BIG-IP TMM vulnerability could lead to denial of service and urged immediate patching. This was a government advisory amplifying F5's disclosure rather than a separate vulnerability event.
On 2026-02-18, F5 published security advisory AV26-144 for a BIG-IP TMM vulnerability tracked as CVE-2026-2507 affecting certain BIG-IP products, including BIG-IP AFM and DDoS Hybrid Defender in the 17.x train. The advisory referenced version 17.5.1.4 and directed customers to apply the available updates to remediate the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **`CVE-2025-53521`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a flaw in **F5 BIG-IP Access Policy Manager (APM)**. The vulnerability affects BIG-IP **17.x, 16.x, and 15.x** when an APM access policy is configured on a virtual server, and specially crafted unauthenticated traffic can crash and restart the **TMM** process, creating a path to potential **root-level remote code execution**. F5 had initially treated the issue as a denial-of-service bug, but reclassified it as **RCE** after new information emerged, sharply raising the severity of the threat. F5 said fixes were released in February 2025, with patched versions including **17.1.0.4**, **16.1.4.3**, and **15.1.10.2** or later, and warned that end-of-technical-support systems should be considered unprotected. CISA ordered Federal Civilian Executive Branch agencies covered by **BOD 22-01** to remediate by **March 30, 2026**, while urging organizations to assess internet-exposed F5 devices, review F5-published indicators of compromise and attacker tradecraft, and investigate for signs of intrusion. Reporting also noted the KEV listing comes after F5's earlier nation-state compromise, which allegedly exposed source code and undisclosed vulnerability information.
Jun 29, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026
F5 issued an out-of-band security notification, `K000162872`, addressing vulnerabilities affecting BIG-IP, BIG-IQ, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript, APM Clients, and BIG-IP APM. The Canadian Centre for Cyber Security and Guyana National CIRT published advisories urging organizations to review the notification and deploy the applicable vendor remediations. Affected BIG-IP installations include systems running releases earlier than `17.1.3.4`, `17.5.1.8`, `21.0.0.3`, or `21.1.0.1`; affected NGINX Ingress Controller versions are earlier than `2026-lts-r5` and `5.6.0`. Administrators should identify exposed F5 deployments, validate installed modules and versions, and prioritize upgrades to the specified fixed releases when available.
Sep 7, 2026