CVE-2026-34019: BIG-IP BFD vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-410

Description

When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 BIG-IP APM: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
BIG-IP: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Advanced Web Application Firewall: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Analytics: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Networks, Inc. BIG-IP (AAM): from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
BIG-IP ASM: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Application Visibility And Reporting: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Automation Toolchain: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Carrier-Grade Nat: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 BIG-IP Container Ingress Services: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Ddos Hybrid Defender: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 BIG-IP DNS: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Edge Gateway: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Fraud Protection Service: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Global Traffic Manager: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Link Controller: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 BIG-IP (LTM): from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Networks, Inc. BIG-IP (PEM): from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Ssl Orchestrator: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Webaccelerator: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0
F5 Big-Ip Websafe: from 17.1.0 through 17.1.2; from 16.1.0 through 16.1.6; 17.5.0

References

https://my.f5.com/manage/s/article/K000150508

Get alerted when CVE-2026-34019 or the next vulnerability affects your stack