Login Request a demo
BI
Network Security
BIG-IP
by F5 · last CVE Sep 22, 2026
On CISA KEVExploited in the wildRansomware-linked
79
CVEs
7
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities79In the news11Timeline
Severity mix
Critical 10High 40Medium 24Low 2
Severity
All severities79Critical10High40Medium24Low2
Exploitation
On CISA KEV7Exploited in the wild7
Watch

Add BIG-IP to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-94127
In wildKEV
9.8
25%
Sep 22
BIG-IP APM OAuth vulnerability
Affected: 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; 17.5.0 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; 17.1.0 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
CVE-2025-53521
In wildKEV
9.8
2%
Oct 15
BigIP APM Vulnerability
Affected: 17.5.0 before 17.5.1.3; 17.1.0 before 17.1.3; 16.1.0 before 16.1.6.1; 15.1.0 before 15.1.10.8
CVE-2023-46747
RansomwareIn wildKEV
9.8
97%
Oct 26
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Affected: 17.1.0; 16.1.0; 15.1.0; 14.1.0; 13.1.0
CVE-2022-1388
RansomwareIn wildKEV
9.8
100%
May 5
F5 BIG-IP Missing Authentication Vulnerability
Affected: 16.1.x before 16.1.2.2; 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5; 12.1.x through 12.1.6; 11.6.x through 11.6.5
CVE-2021-22991
In wildKEV
9.8
62%
Mar 31
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Affected: 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3
CVE-2020-5902
RansomwareIn wildKEV
9.8
100%
Jul 1
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Affected: 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1
CVE-2023-46748
In wildKEV
8.8
4%
Oct 26
BIG-IP Configuration utility authenticated SQL injection vulnerability
Affected: 17.1.0; 16.1.0; 15.1.0; 14.1.0; 13.1.0
CVE-2022-35728
9.8
1%
Aug 4
iControl REST vulnerability CVE-2022-35728
Affected: 13.1.0 before 13.1.x*; 14.1.x before 14.1.5.1; 15.1.x before 15.1.6.1; 16.1.x before 16.1.3.1; 17.0.x before 17.0.0.1
CVE-2026-41225
9.1
0%
May 13
iControl REST vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2022-35243
9.1
1%
Aug 4
Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243
Affected: 13.1.0 before 13.1.x*; 14.1.x before 14.1.5; 15.1.x before 15.1.5.1; 16.1.x before 16.1.3
CVE-2022-34865
9.1
0%
Aug 4
Traffic intelligence feeds vulnerability CVE-2022-34865
Affected: 13.1.0 before 13.1.x*; 14.1.x before 14.1.5; 15.1.x before 15.1.6.1
CVE-2026-66842
8.8
0%
Sep 2
BIG-IP and BIG-IQ Configuration utility vulnerability
Affected: 21.1.0 before 21.1.0.1; 21.0.0 before 21.0.0.3; 17.5.0 before 17.5.1.8; 17.1.0 before 17.1.3.4
CVE-2026-41957
8.8
1%
May 13
BIG-IP and BIG-IQ Configuration utility vulnerability
Affected: 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-42930
8.7
0%
May 13
Appliance mode iControl REST vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-42406
8.7
0%
May 13
BIG-IP and BIG-IQ privilege escalation vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-32643
8.7
0%
May 13
BIG-IP and BIG-IQ privilege escalation vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-32673
8.7
0%
May 13
BIG-IP scripted monitor vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-34176
8.7
1%
May 13
Knowledge Appliance mode iControl REST vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-41953
8.7
0%
May 13
BIG-IP Privilege Escalation vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-40631
8.7
0%
May 13
BIG-IP iControl SOAP vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-40698
8.7
0%
May 13
iControl REST and TMSH vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-42924
8.7
0%
May 13
BIG-IP iControl SOAP vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-40061
8.7
0%
May 13
iControl REST and tmsh vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-41217
7.9
0%
May 13
BIG-IP tmsh vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-59762
7.5
1%
Jul 15
BIG-IP HTTP/2 vulnerability
Affected: 21.1.0 before 21.1.0.1; 21.0.0 before 21.0.0.3; 17.5.0 before 17.5.1.8; 17.1.0 before 17.1.3.4
CVE-2026-40423
7.5
0%
May 13
BIG-IP SIP profile vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-39458
7.5
0%
May 13
BIG-IP DNS Cache vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-39455
7.5
0%
May 13
BIG-IP Configuration utility vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2026-40060
7.5
0%
May 13
BIG-IP Advanced WAF and ASM vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-42409
7.5
0%
May 13
BIG-IP HTTP/2 vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-41227
7.5
0%
May 13
BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
Affected: 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-40618
7.5
0%
May 13
BIG-IP SSL/TLS vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.1.5.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-41956
7.5
0%
May 13
BIG-IP TMM Vulnerability
Affected: 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-42920
7.5
0%
May 13
BIG-IP DTLS Vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-40629
7.5
0%
May 13
BIG-IP SSL/TLS vulnerability
Affected: 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-41218
7.5
0%
May 13
BIG-IP PEM iRules vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2026-40067
7.5
0%
May 13
BIG-IP APM Vulnerability
Affected: 21.0.0 before 21.0.0.1; 17.5.0 before 17.5.1.4; 17.1.0 before 17.1.3.1; 16.1.0
CVE-2022-41833
7.5
1%
Oct 19
BIG-IP iRule vulnerability CVE-2022-41833
Affected: 13.1.0 before 13.1.x*
CVE-2022-41832
7.5
1%
Oct 19
BIG-IP SIP vulnerability CVE-2022-41832
Affected: 17.0.x before 17.0.0.1; 16.1.x before 16.1.3.1; 15.1.x before 15.1.6.1; 14.1.x before 14.1.5.1; 13.1.x before 13.1.5.1
CVE-2022-41624
7.5
1%
Oct 19
BIG-IP iRules vulnerability CVE-2022-41624
Affected: 17.0.x before 17.0.0.1; 16.1.x before 16.1.3.2; 15.1.x before 15.1.7; 14.1.x before 14.1.5.2; 13.1.x before 13.1.5.1
CVE-2022-36795
7.5
1%
Oct 19
BIG-IP software SYN cookies vulnerability CVE-2022-36795
Affected: 17.0.x before 17.0.0.1; 16.1.x before 16.1.3.1; 15.1.x before 15.1.7; 14.1.x before 14.1.5.1
CVE-2022-35240
7.5
1%
Aug 4
BIG-IP Message Routing MQTT vulnerability CVE-2022-35240
Affected: 14.1.x before 14.1.5; 15.1.x before 15.1.6.1; 16.1.x before 16.1.2.2
CVE-2022-35236
7.5
1%
Aug 4
HTTP2 profile vulnerability CVE-2022-35236
Affected: 14.1.x before 14.1.5; 15.1.x before 15.1.6.1; 16.1.x before 16.1.2.2
CVE-2022-34862
7.5
1%
Aug 4
TMM vulnerability CVE-2022-34862
Affected: 13.1.0 before 13.1.x*; 14.1.x before 14.1.5; 15.1.x before 15.1.6.1; 16.1.x before 16.1.3.1
CVE-2022-34844
7.5
1%
Aug 4
BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844
Affected: 15.1.x before 15.1.6.1; 16.1.x before 16.1.3.1
CVE-2022-34655
7.5
1%
Aug 4
TMM vulnerability CVE-2022-34655
Affected: 14.1.x before 14.1.5; 15.1.x before 15.1.6.1; 16.0.x before 16.0.1.1
CVE-2022-34651
7.5
1%
Aug 4
BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651
Affected: 15.1.x before 15.1.6.1; 16.1.x before 16.1.3.1
CVE-2022-32455
7.5
1%
Aug 4
TMM vulnerability CVE-2022-32455
Affected: 13.1.0; 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.2.2
CVE-2026-39459
7.2
0%
May 13
iControl REST and tmsh vulnerability
Affected: 21.0.0 before 21.0.0.2; 17.5.0 before 17.5.1.6; 17.1.0 before 17.1.3.2; 16.1.0
CVE-2022-35735
7.2
1%
Aug 4
BIG-IP monitor configuration vulnerability CVE-2022-35735
Affected: 13.1.0 before 13.1.x*; 14.1.x before 14.1.5.1; 15.1.x before 15.1.6.1; 16.1.x before 16.1.3.1
Page 1 of 2 · 79 total
12