Login Request a demo
BE
Product
Big-ip Edge Gateway
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wild
293
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities293In the news1Timeline
Severity mix
Critical 12High 144Medium 115Low 3
Severity
All severities293Critical12High144Medium115Low3
Exploitation
On CISA KEV4Exploited in the wild4
Watch

Add Big-ip Edge Gateway to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2014-7169
In wildKEV
9.8
100%
Sep 25
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Affected: 10.1.0 through 10.2.4; 11.0.0 through 11.3.0
CVE-2014-6271
In wildKEV
9.8
100%
Sep 24
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Affected: 10.1.0 through 10.2.4; 11.0.0 through 11.3.0
CVE-2018-14634
In wildKEV
7.8
15%
Sep 25
Linux Kernel Integer Overflow Vulnerability
Affected: 11.2.1 before 11.6.4; 12.1.0 before 12.1.5; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.0.6
CVE-2014-0196
In wildKEV
5.5
20%
May 7
Linux Kernel Race Condition Vulnerability
Affected: 11.1.0 through 11.3.0
CVE-2019-6609
9.8
1%
Apr 15
Platform dependent weakness
Affected: 12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1
CVE-2018-5506
9.8
1%
Apr 13
In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated…
Affected: 11.5.1 through 11.5.5; 12.1.0 through 12.1.3.1; 11.2.1; 11.6.1; 13.0.0
CVE-2016-5022
9.8
3%
Sep 7
F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3;…
Affected: 11.2.0; 11.2.1; 11.3.0
CVE-2019-6644
9.4
1%
Sep 4
Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all…
Affected: 12.1.3 through 12.1.4; 13.0.0 through 13.1.2; 14.0.0; 14.1.0
CVE-2026-41225
9.1
0%
May 13
iControl REST vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2020-5887
9.1
2%
Apr 30
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port…
Affected: 14.1.0 through 14.1.2.3; 15.0.0 through 15.0.1.2; 15.1.0 through 15.1.0.1
CVE-2019-6649
9.1
1%
Sep 20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive…
Affected: 11.5.2 through 11.5.9; 11.6.1 through 11.6.4; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0; 14.1.0; +1 more
CVE-2019-10744
9.1
5%
Jul 26
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution
Affected: 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.5; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.2
CVE-2019-6592
9.1
1%
Feb 26
On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles
Affected: 14.1.0 through 14.1.0.1
CVE-2011-3188
9.1
5%
May 24
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes…
Affected: 10.1.0 through 10.2.4; 11.0.0 through 11.1.0
CVE-2026-41957
8.8
1%
May 13
BIG-IP and BIG-IQ Configuration utility vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2025-20029
8.8
7%
Feb 5
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands
Affected: 15.1.0 before 15.1.10.6; 16.1.0 before 16.1.5.2; 17.1.0 before 17.1.2.1
CVE-2019-6646
8.8
2%
Sep 4
On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges
Affected: 11.5.2 through 11.6.4; 12.0.0
CVE-2019-6642
8.8
2%
Jul 1
In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1,…
Affected: 11.5.2 through 11.6.4; 12.1.0 through 12.1.4.2; 13.0.0 through 13.1.1.5; 14.0.0 through 14.1.0.5; 15.0.0
CVE-2016-5020
8.8
3%
Jun 30
F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted…
Affected: 10.2.1; 10.2.2; 10.2.3; 10.2.4; 11.2.1
CVE-2026-42930
8.7
0%
May 13
Appliance mode iControl REST vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-42406
8.7
0%
May 13
BIG-IP and BIG-IQ privilege escalation vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-32643
8.7
0%
May 13
BIG-IP and BIG-IQ privilege escalation vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-32673
8.7
0%
May 13
BIG-IP scripted monitor vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-34176
8.7
1%
May 13
Knowledge Appliance mode iControl REST vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-41953
8.7
0%
May 13
BIG-IP Privilege Escalation vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-40631
8.7
0%
May 13
BIG-IP iControl SOAP vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-40698
8.7
0%
May 13
iControl REST and TMSH vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42924
8.7
0%
May 13
BIG-IP iControl SOAP vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2025-61958
8.7
0%
Oct 15
A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.1
CVE-2025-59481
8.7
0%
Oct 15
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-53868
8.7
0%
Oct 15
When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-31644
8.7
24%
May 7
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated…
Affected: 15.1.0 before 15.1.10.7; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2
CVE-2019-6974
8.1
17%
Feb 15
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free
Affected: 13.0.0 through 13.1.1; 14.0.0 through 14.1.0; 15.0.0 before 15.1.0
CVE-2018-5542
8.1
1%
Jul 25
F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server
Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.0.1
CVE-2018-5504
8.1
4%
Mar 22
In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a…
Affected: 12.1.0 before 12.1.3.2; 13.0.0 before 13.1.0.4
CVE-2017-6164
8.1
4%
Dec 21
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1…
Affected: 11.6.0 through 11.6.1; 12.0.0 through 12.1.2; 11.5.0; 11.5.1; 11.5.2; 11.5.3; +2 more
CVE-2025-24320
8.0
0%
Feb 5
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 15.1.0 before 15.1.10.6; 16.1.0 before 16.1.5.2; 17.1.0 before 17.1.2
CVE-2024-31156
8.0
1%
May 8
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2026-41217
7.9
0%
May 13
BIG-IP tmsh vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2023-43611
7.8
0%
Oct 10
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  This vulnerability is due to an incomplete fix…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2020-5858
7.8
0%
Mar 27
On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles…
Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3; 14.1.0 through 14.1.2; 15.0.0 through 15.0.1
CVE-2019-6685
7.8
0%
Dec 23
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules…
Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.2; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.2.3; 15.0.0 before 15.1.0
CVE-2019-9075
7.8
2%
Feb 24
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32
Affected: 14.1.0; 15.0.0
CVE-2018-13405
7.8
1%
Jul 6
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory…
Affected: 13.0.0 before 13.1.3.5; 14.0.0 before 14.1.3.1; 15.0.0 before 15.0.1.4; 15.1.0; 16.0.0
CVE-2026-40423
7.5
0%
May 13
BIG-IP SIP profile vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-39458
7.5
0%
May 13
BIG-IP DNS Cache vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-39455
7.5
0%
May 13
BIG-IP Configuration utility vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42409
7.5
0%
May 13
BIG-IP HTTP/2 vulnerability
Affected: 21.0.0; 16.1.0 through 16.1.6; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2026-40618
7.5
0%
May 13
BIG-IP SSL/TLS vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-41956
7.5
0%
May 13
BIG-IP TMM Vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
Page 1 of 6 · 293 total
12…6