CVE-2022-26890

7.5 HIGH

Denial of Service

📋 TL;DR

This vulnerability in F5 BIG-IP Advanced WAF, ASM, and APM allows remote attackers to cause denial of service by terminating the bd process. It affects systems with specific configurations where ASM/Advanced WAF with Session Awareness and APM are both enabled on a virtual server. Organizations running affected versions with these configurations are vulnerable.

💻 Affected Systems

Products:

• F5 BIG-IP Advanced WAF
• F5 BIG-IP ASM
• F5 BIG-IP APM

Versions: 16.1.x prior to 16.1.2.1, 15.1.x prior to 15.1.5, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5

Operating Systems: F5 TMOS

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when ASM or Advanced WAF with Session Awareness AND APM are configured on the same virtual server with 'Use APM Username and Session ID' enabled.

📦 What is this software?

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Access Policy Manager by F5

View all CVEs affecting Big Ip Access Policy Manager →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Advanced Web Application Firewall by F5

View all CVEs affecting Big Ip Advanced Web Application Firewall →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

Big Ip Application Security Manager by F5

View all CVEs affecting Big Ip Application Security Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service for affected virtual servers, disrupting application availability and potentially requiring manual intervention to restart services.

🟠

Likely Case

Intermittent service disruptions affecting web applications protected by the vulnerable configuration, leading to downtime and performance degradation.

🟢

If Mitigated

Minimal impact with proper network segmentation and monitoring, though the vulnerability still exists until patched.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability can be triggered by undisclosed requests, suggesting relatively simple exploitation once details are known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 16.1.2.1, 15.1.5, 14.1.4.6, 13.1.5 or later

Vendor Advisory: https://support.f5.com/csp/article/K03442392

Restart Required: Yes

Instructions:

1. Download appropriate patch version from F5 Downloads. 2. Backup configuration. 3. Apply patch via F5 management interface. 4. Restart affected services. 5. Verify fix.

🔧 Temporary Workarounds

Disable vulnerable configuration

all

Disable either ASM/Advanced WAF Session Awareness or APM on affected virtual servers to break the vulnerable configuration chain.

Copy

tmsh modify ltm virtual <virtual_server_name> profiles delete { <asm_profile> }
tmsh modify ltm virtual <virtual_server_name> profiles delete { <apm_profile> }

🧯 If You Can't Patch

• Implement network segmentation to restrict access to affected virtual servers
• Enable monitoring for bd process crashes and implement automated restart procedures

🔍 How to Verify

Check if Vulnerable:

Copy

Check BIG-IP version with 'tmsh show sys version' and verify if ASM/Advanced WAF with Session Awareness and APM are configured on same virtual server with 'Use APM Username and Session ID' enabled.

Check Version:

Copy

tmsh show sys version

Verify Fix Applied:

Copy

Verify version is patched with 'tmsh show sys version' and test with traffic that previously caused crashes.

📡 Detection & Monitoring

Log Indicators:

• bd process termination logs in /var/log/ltm
• Increased restart events for bd process
• Error messages related to session handling

Network Indicators:

• Unusual traffic patterns to virtual servers with ASM+APM configuration
• Sudden service unavailability spikes

SIEM Query:

Copy

source="/var/log/ltm" AND "bd.*terminated" OR "bd.*crashed"

📊 Metadata

CVE ID: CVE-2022-26890

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-670

Published: May 5, 2022

Last Updated: November 21, 2024

🔗 References

• https://support.f5.com/csp/article/K03442392 Vendor Advisory
• https://support.f5.com/csp/article/K03442392 Vendor Advisory

📤 Share & Export

Twitter LinkedIn Reddit Copy Link

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-26890, you might also want to check these:

CVE-2020-1914 9.8

A logic vulnerability in Facebook Hermes JavaScript engine allows attackers to potentially read out ...

Same vulnerability type (CWE-670)

CVE-2025-43359 9.8

This CVE describes a UDP socket binding vulnerability in Apple operating systems where a UDP server ...

Same vulnerability type (CWE-670)

CVE-2025-29312 9.1

This vulnerability in ONOS (Open Network Operating System) v2.7.0 allows attackers to trigger unexpe...

Same vulnerability type (CWE-670)