CVE-2026-22548: F5 BIG-IP Advanced Web Application Firewall

Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days.

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP Advanced Web Application Firewall: from 17.1.0, before 17.1.3 (fixed in 17.1.3)
• F5 BIG-IP Application Security Manager: from 17.1.0, before 17.1.3 (fixed in 17.1.3)

Published 2026-02-04. Last modified 2026-06-17.