Login Request a demo
BS
Product
Big-ip Ssl Orchestrator
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wildRansomware-linked
147
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities147In the news0Timeline
Severity mix
Critical 3High 89Medium 53Low 2
Severity
All severities147Critical3High89Medium53Low2
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add Big-ip Ssl Orchestrator to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-41430
7.5
0%
Oct 15
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
Affected: 15.1.0 through 15.1.9; 16.1.0 before 16.1.4; 17.1.0 before 17.1.3; 17.5.0
CVE-2025-52585
7.5
0%
Aug 13
When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can…
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2
CVE-2025-41433
7.5
0%
May 7
When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed…
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2025-41414
7.5
0%
May 7
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of…
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2025-41399
7.5
0%
May 7
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note:…
Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0
CVE-2025-36504
7.5
0%
May 7
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note: Software versions…
Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-21091
7.5
0%
Feb 5
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-21087
7.5
0%
Feb 5
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU…
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-20058
7.5
0%
Feb 5
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which…
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-20045
7.5
0%
Feb 5
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server,…
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2024-41727
7.5
0%
Aug 14
In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory…
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-41164
7.5
0%
Aug 14
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to…
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-39778
7.5
0%
Aug 14
When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-33608
7.5
1%
May 8
When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate
Affected: 17.1.0
CVE-2024-25560
7.5
1%
May 8
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.4; 17.1.0
CVE-2023-41085
7.5
1%
Oct 10
When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2023-40542
7.5
1%
Oct 10
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.  Note:…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2023-40534
7.5
1%
Oct 10
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated…
Affected: 16.1.0 before 16.1.4.1; 17.1.0
CVE-2023-29163
7.5
1%
May 3
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions…
Affected: 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0
CVE-2023-23555
7.5
1%
Feb 1
On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0,…
Affected: 14.1.5 before 14.1.5.3; 15.1.4 before 15.1.8
CVE-2023-22842
7.5
1%
Feb 1
On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8.1; 16.1.0 before 16.1.3.3
CVE-2023-22664
7.5
1%
Feb 1
On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option…
Affected: 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2023-22422
7.5
1%
Feb 1
On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods:…
Affected: 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2023-22340
7.5
1%
Feb 1
On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2023-22323
7.5
1%
Feb 1
In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8.1; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2022-33203
7.5
1%
Aug 4
BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203
Affected: 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3
CVE-2022-23025
7.5
1%
Jan 25
On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server,…
Affected: 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.1.0 through 16.1.1
CVE-2002-20001
7.5
25%
Nov 11
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive…
Affected: 13.1.0 through 17.1.2; 17.5.0
CVE-2021-23045
7.5
1%
Sep 14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple…
Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.4.1; 14.1.0 before 14.1.4.3; 15.1.0 before 15.1.3.1; 16.0.0 before 16.0.1.2
CVE-2021-23042
7.5
1%
Sep 14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a…
Affected: 12.1.0 before 12.1.6; 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.2
CVE-2021-23009
7.5
1%
May 10
On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic
Affected: 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1
CVE-2021-23013
7.5
1%
May 10
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM)…
Affected: 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1
CVE-2021-23011
7.5
1%
May 10
On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is…
Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.6; 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1
CVE-2021-22977
7.5
1%
Feb 12
On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file
Affected: 14.1.0 before 14.1.3.1; 16.0.0 before 16.0.1.1
CVE-2021-22975
7.5
1%
Feb 12
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the…
Affected: 14.1.0 before 14.1.3.1; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1
CVE-2021-22974
7.5
1%
Feb 12
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated…
Affected: 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.3.1; 15.1.0 before 15.1.2; 16.0.0 before 16.0.1.1
CVE-2020-5949
7.5
1%
Dec 11
On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break
Affected: 13.1.0 before 13.1.3.5; 14.0.0 before 14.1.0
CVE-2020-5939
7.5
1%
Nov 5
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299…
Affected: 13.1.0 through 13.1.3; 14.1.0 before 14.1.2.7; 15.1.0 before 15.1.0.4; 16.0.0 before 16.0.1
CVE-2026-39459
7.2
0%
May 13
iControl REST and tmsh vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2024-45844
7.2
11%
Oct 16
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End…
Affected: 15.1.0 before 15.1.10.5; 16.1.0 before 16.1.5; 17.1.0 before 17.1.1.4
CVE-2023-42768
7.2
1%
Oct 10
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2021-23015
7.2
1%
May 10
On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the…
Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.1
CVE-2026-24464
6.8
1%
May 13
Appliance mode iControl REST vulnerability
Affected: 16.1.0 through 16.1.6; 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2026-42919
6.7
0%
May 13
F5 BIG-IP Appliance Mode Vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6
CVE-2026-41959
6.5
0%
May 13
iControl and tmsh REST vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42937
6.5
0%
May 13
iControl REST and tmsh vulnerability
Affected: 16.1.0 through 16.1.6; 17.1.0 through 17.1.3.1; 17.5.0 through 17.5.1.4
CVE-2026-35062
6.5
0%
May 13
iControl SOAP vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42781
6.5
0%
May 13
BIG-IP FastL4 virtual server vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2026-40699
6.5
0%
May 13
BIG-IP Configuration utility vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-41219
6.5
0%
May 13
BIG-IP QKView vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
Page 2 of 3 · 147 total
123