BA
Product
Big-ip Access Policy Manager
On CISA KEVExploited in the wildRansomware-linked
629
CVEs
13
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 40High 333Medium 127Low 0
Watch
Add Big-ip Access Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-8240 | 7.5 | Apr 11 | The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x… Affected: 11.4.1; 11.5.3; 11.6.0 |
| CVE-2015-5516 | 7.5 | Jan 20 | Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x, 11.5.x before… Affected: 10.1.0; 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; +12 more |
| CVE-2024-28883 | 7.4 | May 8 | An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint… Affected: 15.1.0 before 15.1.10.3; 16.1.0 before 16.1.4.2; 17.1.0 |
| CVE-2020-5913 | 7.4 | Aug 26 | In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even… Affected: 11.6.1 before 11.6.5; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3; 14.1.0 before 14.1.2-0.89.37; 14.1.2.1 before 14.1.2.5; 15.0.0 before 15.0.1.2 |
| CVE-2018-5531 | 7.4 | Jul 25 | Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a denial of service for VCMP… Affected: 11.2.1 through 11.5.6; 11.6.0 through 11.6.3.1; 12.1.0 through 12.1.3.5; 13.0.0 through 13.1.0.7 |
| CVE-2016-2084 | 7.4 | Apr 13 | F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256,… Affected: 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; +4 more |
| CVE-2015-7393 | 7.4 | Jan 12 | dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1,… Affected: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.5.0; 11.5.1; +2 more |
| CVE-2025-48500 | 7.3 | Aug 13 | A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to… Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3 |
| CVE-2017-6145 | 7.3 | Oct 20 | iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization… Affected: 12.1.0; 12.1.1; 12.1.2; 13.0.0 |
| CVE-2026-39459 | 7.2 | May 13 | iControl REST and tmsh vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2024-45844 | 7.2 | Oct 16 | BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End… Affected: 15.1.0 before 15.1.10.5; 16.1.0 before 16.1.5; 17.1.0 before 17.1.1.4 |
| CVE-2024-22389 | 7.2 | Feb 14 | When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2023-42768 | 7.2 | Oct 10 | When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2022-35735 | 7.2 | Aug 4 | BIG-IP monitor configuration vulnerability CVE-2022-35735 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1 |
| CVE-2022-27806 | 7.2 | May 5 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0,… Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more |
| CVE-2022-27634 | 7.2 | May 5 | On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high… Affected: 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 |
| CVE-2021-23015 | 7.2 | May 10 | On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the… Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1 |
| CVE-2021-22990 | 7.2 | Mar 31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems… Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2020-5907 | 7.2 | Jul 1 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh)… Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3; 14.1.0 through 14.1.2; 15.0.0 through 15.1.0 |
| CVE-2020-5873 | 7.2 | Apr 30 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has… Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3.1; 14.1.0 through 14.1.2.3; 15.0.0 through 15.0.1 |
| CVE-2019-6622 | 7.2 | Jul 2 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an… Affected: 11.5.1 through 11.6.4; 12.1.0 through 12.1.4; 13.0.0 through 13.1.1.4; 14.0.0 through 14.1.0.5 |
| CVE-2019-6621 | 7.2 | Jul 2 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1.0-5.4.0, an… Affected: 11.5.2 before 11.5.9; 11.6.1 before 11.6.4; 12.1.0 through 12.1.4; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2019-6620 | 7.2 | Jul 2 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl REST worker… Affected: 11.5.2 through 11.6.4; 12.1.0 through 12.1.4; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.6 |
| CVE-2019-6616 | 7.2 | May 3 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP… Affected: 11.5.2 before 11.5.9; 11.6.1 before 11.6.4; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.2 |
| CVE-2019-6597 | 7.2 | Mar 13 | In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic… Affected: 11.5.1 through 11.5.8; 11.6.1 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.1 |
| CVE-2018-15329 | 7.2 | Dec 20 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User… Affected: 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2 |
| CVE-2018-15327 | 7.2 | Oct 31 | In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI),… Affected: 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2 |
| CVE-2018-5523 | 7.2 | Jun 1 | On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands… Affected: 11.5.1 through 11.5.5; 11.6.1 through 11.6.3; 12.1.0 through 12.1.3; 11.2.1; 13.0.0; 13.1.0 |
| CVE-2018-5511 | 7.2 | Apr 13 | On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP… Affected: 13.0.0; 13.1.0 |
| CVE-2023-43124 | 7.1 | Sep 27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Affected: 14.1.5.2 through 14.1.5.6; 15.1.8 through 15.1.10; 16.1.3.3 through 16.1.4; 13.1.5.1; 17.1.0 |
| CVE-2020-5912 | 7.1 | Aug 26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow… Affected: 11.6.1 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.5; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5 |
| CVE-2020-5880 | 7.1 | Apr 30 | Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization… Affected: 14.1.0 through 14.1.2.3; 15.0.0 through 15.0.1.3 |
| CVE-2018-15332 | 7.0 | Dec 6 | The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of… Affected: 11.5.1 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.1.1; 14.0.0 |
The 500 most important CVEs for this product (exploited first, then by severity)