BA
Product
Big-ip Access Policy Manager
On CISA KEVExploited in the wildRansomware-linked
629
CVEs
13
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 40High 333Medium 127Low 0
Watch
Add Big-ip Access Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-0196 In wildKEV | 5.5 | May 7 | Linux Kernel Race Condition Vulnerability Affected: 11.1.0 through 11.5.1 |
| CVE-2026-24464 | 6.8 | May 13 | Appliance mode iControl REST vulnerability Affected: 16.1.0 through 16.1.6; 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2022-27878 | 6.8 | May 5 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2020-5916 | 6.8 | Aug 26 | In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root… Affected: 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5 |
| CVE-2019-6604 | 6.8 | Mar 28 | On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bridge and using… Affected: 11.2.1 through 11.5.8; 11.6.0 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.1.1; 14.0.0 |
| CVE-2026-42919 | 6.7 | May 13 | F5 BIG-IP Appliance Mode Vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6 |
| CVE-2024-21782 | 6.7 | Feb 14 | BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute… Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2022-33962 | 6.7 | Aug 4 | BIG-IP iRule vulnerability CVE-2022-33962 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1; 17.0.0 |
| CVE-2020-5892 | 6.7 | Apr 30 | In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0 |
| CVE-2026-41959 | 6.5 | May 13 | iControl and tmsh REST vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-42937 | 6.5 | May 13 | iControl REST and tmsh vulnerability Affected: 16.1.0 through 16.1.6; 17.1.0 through 17.1.3.1; 17.5.0 through 17.5.1.4 |
| CVE-2026-35062 | 6.5 | May 13 | iControl SOAP vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-42781 | 6.5 | May 13 | BIG-IP FastL4 virtual server vulnerability Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2026-40699 | 6.5 | May 13 | BIG-IP Configuration utility vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-41219 | 6.5 | May 13 | BIG-IP QKView vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-40462 | 6.5 | May 13 | iControl REST and tmsh vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6 |
| CVE-2025-59483 | 6.5 | Oct 15 | A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-47148 | 6.5 | Oct 15 | When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 |
| CVE-2024-32761 | 6.5 | May 8 | Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms Affected: 15.1.0 before 15.1.10 |
| CVE-2023-41964 | 6.5 | Oct 10 | The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of Technical Support… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2023-22283 | 6.5 | Feb 1 | On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows Affected: 7.2.2 before 7.2.3.1; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.8; 16.1.0 through 16.1.3; 17.0.0 before 17.0.0.2 |
| CVE-2022-41770 | 6.5 | Oct 19 | BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.1; 17.0.0 before 17.0.0.1 |
| CVE-2022-34851 | 6.5 | Aug 4 | BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1; 17.0.0 |
| CVE-2022-28859 | 6.5 | May 5 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh)… Affected: 14.1.0; 14.1.2; 14.1.3; 14.1.4; 15.1.0; 15.1.1; +7 more |
| CVE-2022-25946 | 6.5 | May 5 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0,… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2022-23023 | 6.5 | Jan 25 | On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed… Affected: 12.1.0 through 12.1.5; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.4; 16.1.0 through 16.1.2 |
| CVE-2022-23014 | 6.5 | Jan 25 | On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management… Affected: 15.1.0 before 15.1.4.1; 16.1.0 before 16.1.2 |
| CVE-2021-23043 | 6.5 | Sep 14 | On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP… Affected: 11.6.0 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.0.0 through 16.1.0 |
| CVE-2020-27722 | 6.5 | Dec 24 | In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing… Affected: 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.3.1; 15.0.0 before 15.0.1.4 |
| CVE-2020-27724 | 6.5 | Dec 24 | In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one… Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.3.1; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5; +1 more |
| CVE-2020-5943 | 6.5 | Nov 5 | In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response,… Affected: 14.1.0 through 14.1.0.1; 14.1.2.5 through 14.1.2.7 |
| CVE-2020-5934 | 6.5 | Oct 29 | On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) URL are passing… Affected: 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.4; 15.1.0 before 15.1.1 |
| CVE-2020-5938 | 6.5 | Oct 29 | On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length… Affected: 11.6.1 through 11.6.5.2; 12.1.0 through 12.1.5.2; 13.1.0 through 13.1.3.4 |
| CVE-2019-6662 | 6.5 | Nov 15 | On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request Affected: 13.1.0 before 13.1.1.5 |
| CVE-2019-6641 | 6.5 | Jul 3 | On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash Affected: 12.1.2 through 12.1.4 |
| CVE-2019-6638 | 6.5 | Jul 3 | On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process Affected: 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2019-6634 | 6.5 | Jul 3 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2019-6617 | 6.5 | May 3 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level… Affected: 11.5.2 before 11.5.9; 11.6.1 before 11.6.4; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.2 |
| CVE-2019-6614 | 6.5 | May 3 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.2 |
| CVE-2018-15322 | 6.5 | Oct 31 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and… Affected: 11.2.1 through 11.5.6; 11.6.0 through 11.6.3.2; 12.1.0 through 12.1.3.5; 13.0.0 through 13.1.0.7; 14.0.0 through 14.0.0.2 |
| CVE-2017-6158 | 6.5 | Apr 13 | In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses Affected: 11.5.1 through 11.5.5; 11.6.0 through 11.6.1; 12.0.0 through 12.1.2; 11.2.1 |
| CVE-2017-6134 | 6.5 | Dec 21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence… Affected: 11.5.1 through 11.6.1; 12.1.0 through 12.1.2; 13.0.0 |
| CVE-2017-6156 | 6.4 | Apr 13 | When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or… Affected: 11.5.1 through 11.5.5; 12.1.0 through 12.1.1; 11.2.1; 11.6.1 |
| CVE-2025-61933 | 6.1 | Oct 15 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3 |
| CVE-2025-59269 | 6.1 | Oct 15 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2024-33604 | 6.1 | May 8 | A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the… Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3 |
| CVE-2023-3470 | 6.1 | Aug 2 | Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 |
| CVE-2023-38138 | 6.1 | Aug 2 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.5; 15.1.0 before 15.1.9.1; 16.1.0 before 16.1.3.5; 17.0.0 before 17.1.0.2 |
| CVE-2023-27378 | 6.1 | May 3 | Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0 before 17.1.0.1 |
| CVE-2023-22418 | 6.1 | Feb 1 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
The 500 most important CVEs for this product (exploited first, then by severity)