CVE-2026-40618

HighCVSS 7.5/10Last modified Jun 29, 2026

Description

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-131

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-406197.8A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local CVE-2026-40627.5The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in al CVE-2026-406209.8A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of au CVE-2026-406219.3ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated wi CVE-2026-406227.5NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could ex CVE-2026-406238.1A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified wit CVE-2026-406249.8Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve ar CVE-2026-406279.1An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202 CVE-2026-406297.5When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connect CVE-2026-40634.3The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability c CVE-2026-406309.8A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improp CVE-2026-406318.7An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resul