BA
Product
Big-ip Access Policy Manager
On CISA KEVExploited in the wildRansomware-linked
629
CVEs
13
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 40High 333Medium 127Low 0
Watch
Add Big-ip Access Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-36525 | 7.5 | May 7 | When a BIG-IP APM virtual server is configured to use a PingAccess profile, undisclosed requests can cause TMM to terminate Affected: 15.1.0 before 15.1.10.7.0.4.5; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-36504 | 7.5 | May 7 | When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: Software versions… Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2 |
| CVE-2025-23412 | 7.5 | Feb 5 | When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate Affected: 16.1.3 before 16.1.5; 17.1.0 before 17.1.2 |
| CVE-2025-22846 | 7.5 | Feb 5 | When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to… Affected: 15.1.0 before 15.1.10.6.0.11.6; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2 |
| CVE-2025-21091 | 7.5 | Feb 5 | When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2 |
| CVE-2025-21087 | 7.5 | Feb 5 | When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU… Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2 |
| CVE-2025-20058 | 7.5 | Feb 5 | When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which… Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2 |
| CVE-2025-20045 | 7.5 | Feb 5 | When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server,… Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2 |
| CVE-2024-41727 | 7.5 | Aug 14 | In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory… Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0 |
| CVE-2024-41164 | 7.5 | Aug 14 | When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to… Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0 |
| CVE-2024-39778 | 7.5 | Aug 14 | When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0 |
| CVE-2024-33608 | 7.5 | May 8 | When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate Affected: 17.1.0 |
| CVE-2024-25560 | 7.5 | May 8 | When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2024-24775 | 7.5 | Feb 14 | When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note:… Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2024-23979 | 7.5 | Feb 14 | When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause… Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2024-23314 | 7.5 | Feb 14 | When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions… Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2023-41085 | 7.5 | Oct 10 | When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2023-40542 | 7.5 | Oct 10 | When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note:… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2023-40534 | 7.5 | Oct 10 | When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated… Affected: 16.1.0 before 16.1.4.1; 17.1.0 |
| CVE-2023-29163 | 7.5 | May 3 | When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions… Affected: 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0 |
| CVE-2023-23555 | 7.5 | Feb 1 | On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0,… Affected: 14.1.5 before 14.1.5.3; 15.1.4 before 15.1.8 |
| CVE-2023-22842 | 7.5 | Feb 1 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8.1; 16.1.0 before 16.1.3.3 |
| CVE-2023-22664 | 7.5 | Feb 1 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option… Affected: 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
| CVE-2023-22422 | 7.5 | Feb 1 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods:… Affected: 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
| CVE-2023-22341 | 7.5 | Feb 1 | On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3 |
| CVE-2023-22340 | 7.5 | Feb 1 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
| CVE-2023-22323 | 7.5 | Feb 1 | In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is… Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8.1; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
| CVE-2022-41833 | 7.5 | Oct 19 | BIG-IP iRule vulnerability CVE-2022-41833 Affected: 13.1.0 through 13.1.5 |
| CVE-2022-41832 | 7.5 | Oct 19 | BIG-IP SIP vulnerability CVE-2022-41832 Affected: 13.1.0 before 13.1.5.1; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1; 17.0.0 before 17.0.0.1 |
| CVE-2022-41624 | 7.5 | Oct 19 | BIG-IP iRules vulnerability CVE-2022-41624 Affected: 13.1.0 before 13.1.5.1; 14.1.0 before 14.1.5.2; 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.2; 17.0.0 before 17.0.0.1 |
| CVE-2022-36795 | 7.5 | Oct 19 | BIG-IP software SYN cookies vulnerability CVE-2022-36795 Affected: 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.1; 17.0.0 before 17.0.0.1 |
| CVE-2022-35245 | 7.5 | Aug 4 | BIG-IP APM access policy vulnerability CVE-2022-35245 Affected: 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1 |
| CVE-2022-35240 | 7.5 | Aug 4 | BIG-IP Message Routing MQTT vulnerability CVE-2022-35240 Affected: 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.2.2 |
| CVE-2022-35236 | 7.5 | Aug 4 | HTTP2 profile vulnerability CVE-2022-35236 Affected: 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.2.2 |
| CVE-2022-34862 | 7.5 | Aug 4 | TMM vulnerability CVE-2022-34862 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1 |
| CVE-2022-34844 | 7.5 | Aug 4 | BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844 Affected: 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1 |
| CVE-2022-34655 | 7.5 | Aug 4 | TMM vulnerability CVE-2022-34655 Affected: 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.0.0 before 16.0.1.1 |
| CVE-2022-34651 | 7.5 | Aug 4 | BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651 Affected: 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1 |
| CVE-2022-33203 | 7.5 | Aug 4 | BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203 Affected: 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3 |
| CVE-2022-32455 | 7.5 | Aug 4 | TMM vulnerability CVE-2022-32455 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.2.2 |
| CVE-2022-29491 | 7.5 | May 5 | On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x,… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
| CVE-2022-29473 | 7.5 | May 5 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2022-28706 | 7.5 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic… Affected: 15.1.0; 15.1.1; 15.1.2; 15.1.3; 15.1.4; 15.1.5; +3 more |
| CVE-2022-28705 | 7.5 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +13 more |
| CVE-2022-28701 | 7.5 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource… Affected: 16.1.0; 16.1.1; 16.1.2 |
| CVE-2022-28691 | 7.5 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +13 more |
| CVE-2022-27189 | 7.5 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
| CVE-2022-26890 | 7.5 | May 5 | On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5,… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2022-26517 | 7.5 | May 5 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAT Large Scale NAT (LSN) pool is… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2022-26372 | 7.5 | May 5 | On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
The 500 most important CVEs for this product (exploited first, then by severity)