# Vulnerability in F5 Products (CVE-2026-42015) — BIG-IP Next CNF, BIG-IP Next for Kubernetes, F5OS

> GovCERT.HK/HKCERT issued Security Alert A26-09-38 on 2026-09-24 for CVE-2026-42015, which F5 Advisory K000163397 states affects BIG-IP Next CNF, BIG-IP Next for Kubernetes, F5OS, F5OS-A, and F5OS-C, with impact described as denial of service and tampering. No CVSS score, active-exploitation confirmation, or public PoC is stated, and F5 says updates/mitigations are already available. Independent verification found the CVE ID as registered in NVD and Tenable actually maps to an unrelated GnuTLS PKCS#12 flaw affecting Red Hat products — a discrepancy defenders should resolve with F5/HKCERT before relying on the ID alone.

- **Published:** 2026-09-24T00:00:00Z
- **Last reviewed:** 2026-09-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2660
- **ID:** TL-2026-2660
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42015

## Description

GovCERT.HK (operating on behalf of HKCERT) published Security Alert A26-09-38 on 24 September 2026, forwarding an F5 vendor advisory (K000163397) for CVE-2026-42015. Per the alert, the vulnerability affects BIG-IP Next CNF versions 1.4.0-1.4.2, BIG-IP Next for Kubernetes versions 2.2.0-2.2.2 and 2.3.0, F5OS version 2.0.0, F5OS-A versions 1.5.1-1.5.4 and 1.8.0-1.8.4, and F5OS-C versions 1.6.0-1.6.4 and 1.8.0-1.8.2. The stated impact of successful exploitation is denial of service and tampering on an affected system. Neither the alert nor any source located during this research states a CVSS score, an attack vector (network vs. local, authentication requirement), a root-cause/CWE classification, evidence of a public proof-of-concept, or evidence of active in-the-wild exploitation. F5's advisory states software updates and mitigations for the affected versions were already available at the time of disclosure; F5's own knowledge-base article (my.f5.com, article K000163397) could not be retrieved directly in this research pass because the portal renders its advisory body client-side and returned no substantive content to automated fetches — the technical detail on affected-fix versions and any workaround therefore rests on the HKCERT re-publication rather than the primary F5 text.

IMPORTANT SOURCING CAVEAT: cross-checking CVE-2026-42015 against NVD's REST API and against Tenable's CVE database returned a completely different, unrelated vulnerability: an off-by-one bounds-check error in GnuTLS's PKCS#12 bag-element handling (CWE-193), which allows memory corruption when appending to a bag already containing 32 elements, scored CVSS v3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and affecting Red Hat Enterprise Linux 7-10 and related products (GnuTLS Security Advisory GNUTLS-SA-2026-04-29-11, Red Hat Bugzilla #2467678, RHSA-2026 series advisories). This record has no relationship to F5, BIG-IP, F5OS, or Kubernetes. Because CVE identifiers are meant to be uniquely assigned by a single CNA, this is very unlikely to be a legitimate shared ID — it is far more consistent with a citation/typo error either in F5's own advisory K000163397 or in HKCERT's transcription of it (the correct F5-side CVE for this product/version/impact combination could not be independently located under a different number during this research pass — the affected-product fingerprint does not match any other September 2026 F5 CVE found, including the CVE-2026-33278 / CVE-2026-34986 / CVE-2026-42959 batch HKCERT published on 2026-09-02 for an overlapping BIG-IP Next CNF/Kubernetes/SPK/DNS product set). CVE-2026-42015 is also absent from the CISA Known Exploited Vulnerabilities catalog as of 2026-09-25, consistent with either identifier. Analysts should treat the product/version/impact facts from the HKCERT alert as reliable (they are corroborated internally and match the hunt-phase source), but should NOT pull CVSS, CWE, or technical root-cause detail for CVE-2026-42015 from NVD/Tenable/vulnerability-database tooling, since that data belongs to the unrelated GnuTLS issue — verify the true identifier directly with F5 support before scoring or ticketing this item by CVE number alone.

This disclosure lands in an elevated-risk period for F5 products. In August 2025 F5 identified a long-term, previously undetected compromise of its own corporate network by a nation-state actor, publicly disclosed 15-16 October 2025; the actor exfiltrated BIG-IP source code, information on undisclosed vulnerabilities, and implementation/configuration data for a subset of customers from an internal knowledge-management platform (Unit 42; NCSC UK). CISA responded with Emergency Directive ED 26-01, ordering federal agencies to inventory all BIG-IP (F5OS), BIG-IP (TMOS), BIG-IP Virtual Edition, BIG-IP Next, BIG-IQ, and BNK/CNF instances, check whether management interfaces are internet-exposed, and patch critical systems by 22 October 2025 and remaining devices by 31 October 2025 — the same product family named in this alert. F5 subsequently accelerated its disclosure cadence (45 vulnerabilities in the quarter following the breach vs. 6 the prior quarter), and the pattern has continued through 2026: an out-of-band notification on 2 September 2026 covered further BIG-IP Next CNF/Kubernetes/SPK/DNS issues (CVE-2026-33278, CVE-2026-34986, CVE-2026-42959, DoS and RCE impact), and a separate, unrelated critical BIG-IP APM OAuth-server heap-overflow RCE (CVE-2026-94127, CVSS 9.8) was confirmed under active exploitation and added to the CISA KEV catalog on 22 September 2026 — two days before this alert. Because the threat actor behind the 2025 breach retains stolen BIG-IP source code and undisclosed-vulnerability knowledge that CISA assessed can be used to "develop targeted exploits," any newly disclosed F5 vulnerability in this window carries elevated scrutiny even absent independent confirmation of active exploitation for this specific CVE.

Architecturally, BIG-IP Next CNF and BIG-IP Next for Kubernetes are F5's containerized, cloud-native network functions built to run on Kubernetes/OpenShift for telco, 5G, and cloud-edge traffic-processing use cases, while F5OS (and its F5OS-A/F5OS-C variants) is the base operating system F5 ships on its rSeries/iSeries hardware appliances and that underlies BIG-IP Next deployments. A denial-of-service-and-tampering flaw in this layer therefore has the potential to affect inline, traffic-processing network functions and/or the host OS layer beneath a BIG-IP Next fleet rather than a peripheral management tool, which is consistent with the MEDIUM severity assessment in the absence of a stated CVSS score, RCE, or data-disclosure impact.

Remediation: apply F5's published fix for the affected BIG-IP Next CNF, BIG-IP Next for Kubernetes, F5OS, F5OS-A, and F5OS-C versions per Advisory K000163397 as soon as operationally feasible; confirm whether management interfaces on these devices are internet-exposed and remediate per the same guidance CISA issued in ED 26-01 for this product family; and independently verify the correct CVE identifier with F5 support given the CVE-2026-42015/GnuTLS collision documented above before using the ID in scanning, ticketing, or KEV/NVD-driven prioritization tooling.

## MITRE ATT&CK

- T1499.004 Application or System Exploitation
- T1565 Data Manipulation
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1587.004 Exploits
- T1588.006 Vulnerabilities
- T1601 Modify System Image
- T1595.002 Vulnerability Scanning
- T1592.002 Software

## Sources

- [Security Alert (A26-09-38): Vulnerability in F5 Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=2080)
- [F5 Security Advisory K000163397](https://my.f5.com/manage/s/article/K000163397)
- [MITRE CVE-2026-42015](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015)
- [CVE-2026-42015 Detail (NVD) — registered as an unrelated GnuTLS PKCS#12 flaw](https://nvd.nist.gov/vuln/detail/CVE-2026-42015)
- [CVE-2026-42015 (Tenable CVE database) — GnuTLS PKCS#12 bounds-check error, CWE-193](https://www.tenable.com/cve/CVE-2026-42015)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-42015 absent as of 2026-09-25)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [HKCERT Security Bulletin: F5 Products Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/f5-products-multiple-vulnerabilities_20260902)
- [Threat Brief: Nation-State Threat Actor Steals F5 Source Code and Undisclosed Vulnerabilities](https://unit42.paloaltonetworks.com/nation-state-threat-actor-steals-f5-source-code/)
- [ED 26-01: Mitigate Vulnerabilities in F5 Devices](https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices)
- [Confirmed compromise of F5 network](https://www.ncsc.gov.uk/news/confirmed-compromise-f5-network)
- [F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers](https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2660