Login Request a demo
BD
Product
Big-ip Ddos Hybrid Defender
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wildRansomware-linked
166
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities166In the news0Timeline
Severity mix
Critical 9High 96Medium 59Low 2
Severity
All severities166Critical9High96Medium59Low2
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Big-ip Ddos Hybrid Defender to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-45844
7.2
11%
Oct 16
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End…
Affected: 15.1.0 before 15.1.10.5; 16.1.0 before 16.1.5; 17.1.0 before 17.1.1.4
CVE-2023-42768
7.2
1%
Oct 10
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2021-23015
7.2
1%
May 10
On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the…
Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1
CVE-2021-22990
7.2
9%
Mar 31
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems…
Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1
CVE-2020-5912
7.1
0%
Aug 26
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow…
Affected: 11.6.1 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.5; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5
CVE-2026-24464
6.8
1%
May 13
Appliance mode iControl REST vulnerability
Affected: 16.1.0 through 16.1.6; 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2020-5916
6.8
1%
Aug 26
In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root…
Affected: 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5
CVE-2026-42919
6.7
0%
May 13
F5 BIG-IP Appliance Mode Vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6
CVE-2026-41959
6.5
0%
May 13
iControl and tmsh REST vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42937
6.5
0%
May 13
iControl REST and tmsh vulnerability
Affected: 16.1.0 through 16.1.6; 17.1.0 through 17.1.3.1; 17.5.0 through 17.5.1.4
CVE-2026-35062
6.5
0%
May 13
iControl SOAP vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42781
6.5
0%
May 13
BIG-IP FastL4 virtual server vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2026-40699
6.5
0%
May 13
BIG-IP Configuration utility vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-41219
6.5
0%
May 13
BIG-IP QKView vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-40462
6.5
0%
May 13
iControl REST and tmsh vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6
CVE-2025-59483
6.5
0%
Oct 15
A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2024-32761
6.5
0%
May 8
Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms
Affected: 15.1.0 before 15.1.10
CVE-2023-41964
6.5
0%
Oct 10
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.  Note: Software versions which have reached End of Technical Support…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2022-23023
6.5
1%
Jan 25
On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed…
Affected: 12.1.0 through 12.1.5; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.4; 16.1.0 through 16.1.2
CVE-2020-5943
6.5
1%
Nov 5
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response,…
Affected: 14.1.0 through 14.1.0.1; 14.1.2.5 through 14.1.2.7
CVE-2020-5938
6.5
1%
Oct 29
On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length…
Affected: 11.6.1 through 11.6.5.2; 12.1.0 through 12.1.5.2; 13.1.0 through 13.1.3.4
CVE-2025-59269
6.1
0%
Oct 15
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2024-33604
6.1
0%
May 8
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2023-3470
6.1
0%
Aug 2
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account
Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0
CVE-2023-38138
6.1
0%
Aug 2
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.5; 15.1.0 before 15.1.9.1; 16.1.0 before 16.1.3.5; 17.0.0 before 17.1.0.2
CVE-2023-27378
6.1
0%
May 3
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0 before 17.1.0.1
CVE-2023-22418
6.1
0%
Feb 1
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.3
CVE-2021-23027
6.1
1%
Sep 14
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the…
Affected: 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.0.0 through 16.0.1.1
CVE-2021-22994
6.1
1%
Mar 31
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed…
Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1
CVE-2021-22979
6.1
1%
Feb 12
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS)…
Affected: 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.2.8; 15.1.0 before 15.1.1; 16.0.0 before 16.0.1
CVE-2020-27719
6.1
1%
Dec 24
On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility
Affected: 14.1.0 before 14.1.3.1; 15.0.0 before 15.1.1; 16.0.0 before 16.0.1
CVE-2025-58153
5.9
0%
Oct 15
Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.5.0
CVE-2024-28889
5.9
0%
May 8
When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can…
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2023-22302
5.9
1%
Feb 1
In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the…
Affected: 16.1.2.2 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2020-5929
5.9
1%
Sep 25
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client…
Affected: 11.6.1 before 11.6.2; 12.1.0 before 12.1.2; 11.6.2; 12.1.2; 12.1.2; 13.0.0; +2 more
CVE-2023-43485
5.5
0%
Oct 10
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.  Note: Software versions which have reached End of…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2026-40703
5.4
0%
May 13
BIG-IP Configuration utility CSRF vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2023-38423
5.4
0%
Aug 2
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.5; 15.1.0 before 15.1.9.1; 16.1.0 before 16.1.3.5; 17.0.0 before 17.1.0.2
CVE-2026-34019
5.3
0%
May 13
BIG-IP BFD vulnerability
Affected: 17.1.0 through 17.1.2; 17.5.0; 16.1.0 through 16.1.6
CVE-2026-40435
5.3
0%
May 13
BIG-IP httpd access control vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2025-59268
5.3
0%
Oct 15
On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-58424
5.3
0%
Oct 15
On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection.  Note: Software…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 through 17.1.2
CVE-2025-54500
5.3
0%
Aug 13
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.2
CVE-2023-24594
5.3
1%
May 3
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.   Note: Software versions which…
Affected: 14.1.5; 15.1.4.1; 16.1.2
CVE-2022-23030
5.3
1%
Jan 25
On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv driver (which is…
Affected: 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.4; 16.1.0 through 16.1.1
CVE-2022-23029
5.3
1%
Jan 25
On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a…
Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.4
CVE-2022-23027
5.3
1%
Jan 25
On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash…
Affected: 12.1.5.3 through 12.1.6; 13.1.3.6 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3
CVE-2021-23007
5.3
2%
Mar 31
On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic
Affected: 14.1.4; 16.0.1.1
CVE-2021-22998
5.3
1%
Mar 31
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood…
Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1
CVE-2026-42063
4.9
0%
May 13
iControl SOAP vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
Page 3 of 4 · 166 total
1234