BA
Product
Big-ip Access Policy Manager
On CISA KEVExploited in the wildRansomware-linked
629
CVEs
13
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 40High 333Medium 127Low 0
Watch
Add Big-ip Access Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5922 | 8.8 | Aug 26 | In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections… Affected: 11.6.1 through 11.6.5; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.7; 15.0.0 before 15.1.0.5 |
| CVE-2020-5904 | 8.8 | Jul 1 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface… Affected: 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.5; 15.0.0 through 15.1.0.3 |
| CVE-2020-5897 | 8.8 | May 12 | In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component Affected: 11.6.1 through 11.6.5.1; 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.5; 15.0.0 through 15.1.0.3 |
| CVE-2019-6646 | 8.8 | Sep 4 | On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges Affected: 11.5.2 through 11.6.4; 12.0.0 |
| CVE-2019-6642 | 8.8 | Jul 1 | In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1,… Affected: 11.5.2 through 11.6.4; 12.1.0 through 12.1.4.2; 13.0.0 through 13.1.1.5; 14.0.0 through 14.1.0.5; 15.0.0 |
| CVE-2016-9251 | 8.8 | May 9 | In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection Affected: 12.0.0; 12.1.0; 12.1.1; 12.1.2 |
| CVE-2016-5020 | 8.8 | Jun 30 | F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted… Affected: 11.6.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 11.2.1; +10 more |
| CVE-2026-42930 | 8.7 | May 13 | Appliance mode iControl REST vulnerability Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-42406 | 8.7 | May 13 | BIG-IP and BIG-IQ privilege escalation vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-32643 | 8.7 | May 13 | BIG-IP and BIG-IQ privilege escalation vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-32673 | 8.7 | May 13 | BIG-IP scripted monitor vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-34176 | 8.7 | May 13 | Knowledge Appliance mode iControl REST vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-41953 | 8.7 | May 13 | BIG-IP Privilege Escalation vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-40631 | 8.7 | May 13 | BIG-IP iControl SOAP vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-40698 | 8.7 | May 13 | iControl REST and TMSH vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-42924 | 8.7 | May 13 | BIG-IP iControl SOAP vulnerability Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2025-61958 | 8.7 | Oct 15 | A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.1 |
| CVE-2025-59481 | 8.7 | Oct 15 | A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-53868 | 8.7 | Oct 15 | When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-31644 | 8.7 | May 7 | When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated… Affected: 15.1.0 before 15.1.10.7; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-23239 | 8.7 | Feb 5 | When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint Affected: 17.1.1 |
| CVE-2024-22093 | 8.7 | Feb 14 | When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2023-43746 | 8.7 | Oct 10 | When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a… Affected: 13.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2022-41800 | 8.7 | Dec 7 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.8; 16.1.0 through 16.1.3; 17.0.0 |
| CVE-2019-6610 | 8.6 | Apr 11 | On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL… Affected: 11.5.1 through 11.5.8; 11.6.1 through 11.6.3; 12.1.0 through 12.1.4; 13.0.0 through 13.1.1; 14.0.0 |
| CVE-2023-22374 | 8.5 | Feb 1 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code Affected: 14.1.4.6 through 14.1.5; 15.1.5.1 through 15.1.8; 16.1.2.2 through 16.1.3; 13.1.5; 17.0.0 |
| CVE-2020-5945 | 8.4 | Nov 5 | In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS) Affected: 14.1.0 before 14.1.2.8; 15.1.0 before 15.1.1; 16.0.0 before 16.0.1 |
| CVE-2021-22978 | 8.3 | Feb 12 | On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl… Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.3.1; 15.1.0 before 15.1.1; 16.0.0 before 16.0.1 |
| CVE-2023-43125 | 8.2 | Sep 27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Affected: 14.1.5.2 through 14.1.5.6; 15.1.8 through 15.1.10; 16.1.3.3 through 16.1.4; 13.1.5.1; 17.1.0 |
| CVE-2021-23012 | 8.2 | May 10 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support… Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1 |
| CVE-2023-40537 | 8.1 | Oct 10 | An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note:… Affected: 13.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2020-5906 | 8.1 | Jul 1 | In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3 |
| CVE-2020-5888 | 8.1 | Apr 30 | On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local… Affected: 14.0.0 before 14.1.2.4; 15.0.0 before 15.0.1.3; 15.1.0 before 15.1.0.2 |
| CVE-2020-5876 | 8.1 | Apr 30 | On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted… Affected: 11.6.1 through 11.6.5.1; 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.3; 15.0.0 through 15.1.0.3 |
| CVE-2020-5860 | 8.1 | Mar 27 | On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA)… Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3; 14.1.0 through 14.1.2; 15.0.0 through 15.1.0 |
| CVE-2019-6974 | 8.1 | Feb 15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free Affected: 13.0.0 through 13.1.1; 14.0.0 through 14.1.0; 15.0.0 before 15.1.0 |
| CVE-2018-5542 | 8.1 | Jul 25 | F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.0.1 |
| CVE-2018-5504 | 8.1 | Mar 22 | In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a… Affected: 12.1.0 before 12.1.3.2; 13.0.0 before 13.1.0.4 |
| CVE-2017-6164 | 8.1 | Dec 21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1… Affected: 11.6.0 through 11.6.1; 12.0.0 through 12.1.2; 11.5.0; 11.5.1; 11.5.2; 11.5.3; +2 more |
| CVE-2017-6157 | 8.1 | Oct 27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers… Affected: 11.5.0 through 11.5.4; 11.6.0; 11.6.1; 12.0.0; 12.1.0; 12.1.1 |
| CVE-2015-7547 | 8.1 | Feb 18 | Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote… Affected: 12.0.0 |
| CVE-2025-24320 | 8.0 | Feb 5 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the… Affected: 15.1.0 before 15.1.10.6; 16.1.0 before 16.1.5.2; 17.1.0 before 17.1.2 |
| CVE-2024-31156 | 8.0 | May 8 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the… Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3 |
| CVE-2026-41217 | 7.9 | May 13 | BIG-IP tmsh vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2023-5450 | 7.8 | Oct 10 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation… Affected: 7.2.3 before 7.2.4.5; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.10; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2023-43611 | 7.8 | Oct 10 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix… Affected: 7.2.3 before 7.2.4.4; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2023-38418 | 7.8 | Aug 2 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.9; 16.1.0 through 16.1.3; 17.0.0 through 17.1.0 |
| CVE-2023-22358 | 7.8 | Feb 1 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer Affected: 7.2.2 before 7.2.3.1; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.8; 16.1.0 through 16.1.3; 17.0.0 before 17.0.0.2 |
| CVE-2022-28714 | 7.8 | May 5 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
| CVE-2022-29263 | 7.8 | May 5 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
The 500 most important CVEs for this product (exploited first, then by severity)