BIG-IP APM, BIG-IP DNS: verify session actions

Published · Updated · APIs and connected services · 9 min read · By Cyber Intelligence Embassy

At a glance

BIG-IP APM, BIG-IP DNS: cross-site request forgery (CSRF). This 2026-05-16 case examines 43 version entries and 51 CVEs, documented releases and checks suited to network access, using CERTFR-2026-AVI-0591.

AI illustration: a dark cybersecurity technology space with restrained golden lighting Illustration · fictional scene
In this article

Retrospective for 2026-05-16, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.

What this advisory changes in your environment

The starting point is CERTFR-2026-AVI-0591, published on 2026-05-15. Its scope includes BIG-IP APM, BIG-IP DNS, BIG-IP Advanced WAF/ASM, BIG-IP, BIG-IP Next for Kubernetes, F5 DoS for NGINX, BIG-IP Next SPK, BIG-IP SSL Orchestrator, NGINX Open Source, BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender, NGINX Gateway Fabric, BIG-IP Next CNF. Reported consequences are remote code execution, privilege escalation, denial of service, loss of confidentiality, data integrity compromise, security control bypass, cross-site request forgery (CSRF). These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.

This case contains 43 version entries; CVE identifier count: 51. Track remediation by component: a successful overall update does not demonstrate that BIG-IP APM and F5 WAF for NGINX each received their respective fix.

Products and versions to examine

Reference
CERTFR-2026-AVI-0591
Source first published
2026-05-15
Latest source revision available for this day
2026-05-15
Named components
BIG-IP APM, BIG-IP DNS, BIG-IP Advanced WAF/ASM, BIG-IP, BIG-IP Next for Kubernetes, F5 DoS for NGINX, BIG-IP Next SPK, BIG-IP SSL Orchestrator, NGINX Open Source, BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender, NGINX Gateway Fabric, BIG-IP Next CNF, NGINX App Protect DoS, NGINX App Protect WAF, NGINX Ingress Controller, NGINX Instance Manager, NGINX Plus, BIG-IQ Centralized Management, BIG-IP PEM, F5 WAF for NGINX
CVE identifiers
CVE-2026-41227, CVE-2026-39458, CVE-2026-42781, CVE-2026-42780, CVE-2026-40701, CVE-2026-42920, CVE-2026-42409, CVE-2026-42946, CVE-2026-42937, CVE-2026-42919, CVE-2026-42934, CVE-2026-42406, CVE-2026-40435, CVE-2026-34176, CVE-2026-40629, CVE-2026-32673, CVE-2026-41953, CVE-2026-40061, CVE-2026-42924, CVE-2026-41225, CVE-2026-35062, CVE-2026-40423, CVE-2026-34019, CVE-2026-42926 … (+27)
ComponentPublished condition
BIG-IP APM17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP DNS17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP Advanced WAF/ASM17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP Next for Kubernetes2.x : < 2.2.0
BIG-IP16.1.0 – 16.1.6 : < 17.1.3
BIG-IP DNS17.5.0 – 17.5.1 : < 21.0.0
BIG-IP Next SPK1.7.0 – 1.7.16 : < 1.7.17
BIG-IP21.0.x : < 21.0.0.2
BIG-IP SSL Orchestrator21.0.0 : < 21.0.0.1 (SSL Orchestrator 13.1.3)
BIG-IP Next SPK2.0.0 – 2.0.2 : < 2.0.3
NGINX Open Source1.0.0 – 1.30.0 : < 1.30.1
BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP Next CNF2.0.0 – 2.0.2 : < 2.0.3
BIG-IP APM17.5.0 – 17.5.1 : < 17.5.1.4
BIG-IP SSL Orchestrator17.1.0 – 17.1.3 : < 17.1.3.1 (SSL Orchestrator 12.3.2)
BIG-IP17.5.0 – 17.5.1 : < 21.0.0.2
NGINX Open Source0.3.50 – 0.9.7 : < 1.30.1
BIG-IP DNS21.0.x : < 21.0.0.1
BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender17.5.0 – 17.5.1 : < 17.5.1.4
NGINX PlusR36 : < R36 P4
BIG-IQ Centralized Management8.4.0 : < 8.4.1
BIG-IP SSL Orchestrator17.5.0 – 17.5.1 : < 17.5.1.4 (SSL Orchestrator 12.3.2)
BIG-IP Next CNF1.1.0 – 1.4.0 : < 1.4.1
BIG-IP PEM17.1.0 – 17.1.3 : < 17.1.3.1
BIG-IP APM21.0.x : < 21.0.0.1
BIG-IP DNS16.1.0 – 16.1.6 : < 17.1.3.1
BIG-IP PEM21.0.x : < 21.0.0.1
BIG-IP Advanced WAF/ASM17.5.0 – 17.5.1 : < 17.5.1.4
BIG-IP Advanced WAF/ASM21.0.x : < 21.0.0.1
BIG-IP PEM17.5.0 – 17.5.1 : < 17.5.1.4
NGINX PlusR32 : < R32 P6

For BIG-IP APM, the published condition is “17.1.0 – 17.1.3 : < 17.1.3.1”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of BIG-IP APM, BIG-IP DNS does not close this case.

Mechanism and prerequisites

CSRF can misuse a session that is already authenticated. Check origin validation and anti-CSRF tokens on sensitive actions alongside cookie settings; authentication does not protect every action by itself.

The primary record CVE-2026-41227, published by f5, covers BIG-IP. The retained revision is dated 2026-05-13. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-0591.

The published metric for CVE-2026-41227 is CVSS 4.0, 8.7/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector
network
Prior privileges
none
User interaction
none
Complexity
low
Additional attack requirements
none
Weakness
CWE-770

Choose the appropriate intervention

  1. Locate BIG-IP APM instances, running releases and service owners. Record condition 17.1.0 – 17.1.3 : < 17.1.3.1 in the ticket alongside reference CERTFR-2026-AVI-0591.
  2. Compare the installed branch with the vendor’s BIG-IP APM release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
  3. After changing BIG-IP APM, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.

Verify the fix in a real workflow

Validation scenario to adapt for BIG-IP APM, BIG-IP DNS: For BIG-IP APM, test an authorised business flow from each zone reaching the service and confirm management restrictions. If a redundant pair exists, verify both nodes and rule persistence after failover during a planned maintenance window. This is a proposed defensive check, not a claim that testing was performed against third-party systems.

Limit of case CERTFR-2026-AVI-0591: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.

Questions specific to this case

Which condition should be checked for BIG-IP APM?

Advisory CERTFR-2026-AVI-0591 states: BIG-IP APM — 17.1.0 – 17.1.3 : < 17.1.3.1. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.

Why not use one fix for BIG-IP APM and F5 WAF for NGINX?

CERTFR-2026-AVI-0591 distinguishes these components within a scope containing 43 entries. Match each branch to its own update documentation and functional check.

Which prerequisites does record CVE-2026-41227 specify?

For CVE-2026-41227, the published vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Verify those conditions on BIG-IP before applying them to an integration named in CERTFR-2026-AVI-0591.

Sources and related reading

Practical guide : Software inventory: prepare for end of support

Explore the decision addressed in this case

Complete source advisory inventory

The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.

Official source · CERTFR-2026-AVI-0591
Advisory revision : · Checked on :

Affected systems · 43

Original French wording is retained to avoid ambiguous translations of version conditions.

  1. BIG-IP APM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  2. BIG-IP DNS versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  3. BIG-IP Advanced WAF/ASM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  4. BIG-IP versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  5. BIG-IP Next for Kubernetes versions 2.x antérieures à 2.2.0
  6. F5 DoS for NGINX versions 4.8.0
  7. BIG-IP versions 16.1.0 à 16.1.6 antérieures à 17.1.3
  8. BIG-IP DNS versions 17.5.0 à 17.5.1 antérieures à 21.0.0
  9. BIG-IP Next SPK versions 1.7.0 à 1.7.16 antérieures à 1.7.17
  10. BIG-IP versions 21.0.x antérieures à 21.0.0.2
  11. BIG-IP SSL Orchestrator versions 21.0.0 antérieures à 21.0.0.1 (SSL Orchestrator 13.1.3)
  12. BIG-IP Next SPK versions 2.0.0 à 2.0.2 antérieures à 2.0.3
  13. NGINX Open Source versions 1.0.0 à 1.30.0 antérieures à 1.30.1
  14. BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  15. NGINX Gateway Fabric versions 1.3.0 à 1.6.2
  16. BIG-IP Next CNF versions 2.0.0 à 2.0.2 antérieures à 2.0.3
  17. NGINX App Protect DoS versions 4.3.0 à 4.7.0
  18. BIG-IP APM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4
  19. NGINX App Protect WAF versions 4.9.0 à 4.16.0
  20. BIG-IP SSL Orchestrator versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 (SSL Orchestrator 12.3.2)
  21. NGINX Ingress Controller versions 5.0.0 à 5.4.2
  22. BIG-IP versions 17.5.0 à 17.5.1 antérieures à 21.0.0.2
  23. NGINX Ingress Controller versions 3.5.0 à 3.7.2
  24. NGINX Open Source versions 0.3.50 à 0.9.7 antérieures à 1.30.1
  25. BIG-IP DNS versions 21.0.x antérieures à 21.0.0.1
  26. NGINX Instance Manager versions 2.16.0 à 2.21.1
  27. BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4
  28. NGINX Plus versions R36 antérieures à R36 P4
  29. BIG-IQ Centralized Management versions 8.4.0 antérieures à 8.4.1
  30. BIG-IP SSL Orchestrator versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 (SSL Orchestrator 12.3.2)
  31. BIG-IP Next CNF versions 1.1.0 à 1.4.0 antérieures à 1.4.1
  32. NGINX App Protect WAF versions 5.1.0 à 5.8.0
  33. NGINX Gateway Fabric versions 2.0.0 à 2.6.0
  34. NGINX Ingress Controller versions 4.0.0 à 4.0.1
  35. BIG-IP PEM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1
  36. BIG-IP APM versions 21.0.x antérieures à 21.0.0.1
  37. BIG-IP DNS versions 16.1.0 à 16.1.6 antérieures à 17.1.3.1
  38. BIG-IP PEM versions 21.0.x antérieures à 21.0.0.1
  39. BIG-IP Advanced WAF/ASM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4
  40. BIG-IP Advanced WAF/ASM versions 21.0.x antérieures à 21.0.0.1
  41. BIG-IP PEM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4
  42. NGINX Plus versions R32 antérieures à R32 P6
  43. F5 WAF for NGINX versions 5.9.0 à 5.12.1
CVE identifiers · 51