A misconfiguration in BIG‑IP Advanced WAF or ASM security policies can cause the bd process to terminate unexpectedly when the system receives certain undocumented requests combined with conditions outside the attacker’s direct control. The resulting crash leads to a denial of service, disrupting the availability of the protected application or virtual server. The vulnerability is a concurrency issue (CWE‑362) and does not directly affect confidentiality or integrity. The impact is limited to the affected virtual instance and the control plane managing it.

F5 BIG‑IP Advanced Web Application Firewall and F5 BIG‑IP Application Security Manager are impacted. The advisory does not list specific firmware versions, but the issue applies to any active release in which the advanced WAF or ASM policy is enabled on a virtual server. End of Technical Support versions are excluded from assessment.

The CVSS score of 8.2 indicates high severity. The EPSS probability is reported as less than 1 %, implying a very low expected exploitation rate at present, but it remains plausible once the vulnerability is known for public exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to craft or trigger the undocumented requests against a configured virtual server, which is possible from any network that can reach the F5 device. The crash would deplete the affected service, but no code execution or data exfiltration is possible based on the current description.