Login Request a demo
BW
Product
Big-ip Webaccelerator
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wildRansomware-linked
295
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities295In the news1Timeline
Severity mix
Critical 12High 149Medium 113Low 3
Severity
All severities295Critical12High149Medium113Low3
Exploitation
On CISA KEV5Exploited in the wild5
Watch

Add Big-ip Webaccelerator to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2014-0196
In wildKEV
5.5
20%
May 7
Linux Kernel Race Condition Vulnerability
Affected: 11.1.0 through 11.3.0
CVE-2026-24464
6.8
1%
May 13
Appliance mode iControl REST vulnerability
Affected: 16.1.0 through 16.1.6; 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2019-6604
6.8
1%
Mar 28
On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bridge and using…
Affected: through 14.0.0; 11.2.1 through 11.5.8; 11.6.0 through 11.6.3; 12.0.0 through 12.1.3; 13.0.0 through 13.1.1
CVE-2026-42919
6.7
0%
May 13
F5 BIG-IP Appliance Mode Vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6
CVE-2026-41959
6.5
0%
May 13
iControl and tmsh REST vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42937
6.5
0%
May 13
iControl REST and tmsh vulnerability
Affected: 16.1.0 through 16.1.6; 17.1.0 through 17.1.3.1; 17.5.0 through 17.5.1.4
CVE-2026-35062
6.5
0%
May 13
iControl SOAP vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2026-42781
6.5
0%
May 13
BIG-IP FastL4 virtual server vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1
CVE-2026-40699
6.5
0%
May 13
BIG-IP Configuration utility vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-41219
6.5
0%
May 13
BIG-IP QKView vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-40462
6.5
0%
May 13
iControl REST and tmsh vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0; 16.1.0 through 16.1.6
CVE-2025-59483
6.5
0%
Oct 15
BIG-IP Configuration utility and tmsh vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2024-32761
6.5
0%
May 8
Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms
Affected: 15.1.0 before 15.1.10
CVE-2023-41964
6.5
0%
Oct 10
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.  Note: Software versions which have reached End of Technical Support…
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2019-6662
6.5
1%
Nov 15
On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request
Affected: 13.1.0 before 13.1.1.5
CVE-2019-6641
6.5
2%
Jul 3
On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash
Affected: 12.1.2 through 12.1.4
CVE-2019-6638
6.5
2%
Jul 3
On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process
Affected: 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6
CVE-2019-6634
6.5
1%
Jul 3
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process
Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6
CVE-2019-6617
6.5
2%
May 3
On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level…
Affected: 11.5.2 before 11.5.9; 11.6.1 before 11.6.4; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.2
CVE-2019-6614
6.5
1%
May 3
On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective
Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.1.0.2
CVE-2018-15322
6.5
1%
Oct 31
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and…
Affected: 11.2.1 through 11.5.6; 11.6.0 through 11.6.3.2; 12.1.0 through 12.1.3.5; 13.0.0 through 13.1.0.7; 14.0.0 through 14.0.0.2
CVE-2017-6158
6.5
1%
Apr 13
In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses
Affected: 11.5.1 through 11.5.5; 11.6.0 through 11.6.1; 12.0.0 through 12.1.2; 11.2.1
CVE-2017-6156
6.4
1%
Apr 13
When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or…
Affected: 11.5.1 through 11.5.5; 12.1.0 through 12.1.1; 11.2.1; 11.6.1
CVE-2025-59269
6.1
0%
Oct 15
BIG-IP Configuration utility XSS vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2024-33604
6.1
0%
May 8
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the…
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2023-3470
6.1
0%
Aug 2
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account
Affected: 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0
CVE-2023-38138
6.1
0%
Aug 2
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.5; 15.1.0 before 15.1.9.1; 16.1.0 before 16.1.3.5; 17.0.0 before 17.1.0.2
CVE-2023-27378
6.1
0%
May 3
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0 before 17.1.0.1
CVE-2020-5915
6.1
1%
Aug 26
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability…
Affected: 11.5.2 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.0.0 before 14.1.2.4; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5
CVE-2019-6657
6.1
1%
Nov 1
On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management…
Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3
CVE-2019-6625
6.1
1%
Jul 3
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page…
Affected: 11.5.1 through 11.6.3; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6
CVE-2019-6600
6.1
1%
Mar 13
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external…
Affected: 11.5.1 through 11.5.8; 11.6.1 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2
CVE-2019-8331
6.1
16%
Feb 20
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute
Affected: 12.1.0 before 12.1.5.1; 13.0.0 before 13.1.3.4; 14.0.0 before 14.1.2.5; 15.0.0 before 15.1.0
CVE-2019-6589
6.1
1%
Feb 14
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the…
Affected: 11.6.0 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2
CVE-2018-15315
6.1
1%
Oct 19
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page
Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1
CVE-2018-15312
6.1
1%
Oct 19
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that…
Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1
CVE-2018-5521
6.1
1%
Jun 1
On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially…
Affected: 11.5.1 through 11.5.5; 11.6.1 through 11.6.3; 12.1.0 through 12.1.3; 11.2.1
CVE-2025-58153
5.9
0%
Oct 15
BIG-IP HSB vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.5.0
CVE-2024-28889
5.9
0%
May 8
When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can…
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2013-3587
5.9
6%
Feb 21
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for…
Affected: 9.4.0 through 9.4.8; 10.0.0 through 10.2.4; 11.0.0 through 11.3.0
CVE-2020-5854
5.9
1%
Feb 6
On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the…
Affected: 11.5.2 through 11.6.5; 12.1.0 before 12.1.5.1; 13.1.0 before 13.1.3.2; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.2.1; 15.0.0 before 15.1.0
CVE-2019-6471
5.9
3%
Oct 9
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c
Affected: 11.5.2 through 11.5.9; 11.6.1 through 11.6.4; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 9.2.2; 14.0.0; +2 more
CVE-2019-6608
5.9
1%
Mar 28
On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when…
Affected: 11.2.1 through 11.6.3; 12.0.0 through 12.1.3; 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2
CVE-2019-1559
5.9
17%
Feb 27
0-byte record padding oracle
Affected: 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0
CVE-2019-6594
5.9
1%
Feb 26
On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the…
Affected: 11.5.1 through 11.6.3.2; 12.1.3.4 through 12.1.3.7; 13.0.1 through 13.1.1.1; 14.0.0 through 14.0.0.2; 13.0.0; 13.0.0; +1 more
CVE-2019-6593
5.9
1%
Feb 26
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers
Affected: 11.5.1 through 11.5.4; 11.6.1; 12.1.0
CVE-2018-15323
5.9
1%
Oct 31
On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may…
Affected: 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2
CVE-2018-15311
5.9
1%
Oct 10
When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature…
Affected: 11.5.1 through 11.5.6; 11.6.0.0 through 11.6.3.2; 12.1.0.0 through 12.1.3.5; 13.0.0.0 through 13.1.0.5
CVE-2018-5522
5.9
1%
Jun 1
On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash
Affected: 11.5.0 through 11.5.5; 11.6.0 through 11.6.3; 12.0.0 through 12.1.2; 11.2.1; 13.0.0
CVE-2014-4024
5.9
2%
Mar 19
SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1…
Affected: 10.0.0 through 10.2.4; 11.0.0 through 11.3.0
Page 1 of 3 · 113 total
123