F5 Big-Ip vulnerabilities

262 known vulnerabilities affecting f5/big-ip.

Total CVEs

262

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL10HIGH159MEDIUM88LOW5

Vulnerabilities

SortPage 4 of 14

CVE-2025-48008P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2.2≥ 16.1.0, < 16.1.6+1 more2025-10-15

CVE-2025-48008 [HIGH] CWE-416 CVE-2025-48008: When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-46706P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2.2≥ 16.1.0, < 16.1.62025-10-15

CVE-2025-46706 [HIGH] CWE-770 CVE-2025-46706: When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed re When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-23412P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2≥ 16.1.3, < 16.1.52025-02-05

CVE-2025-23412 [HIGH] CWE-120 CVE-2025-23412: When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-22891P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2≥ 16.1.0, < 16.1.5+1 more2025-02-05

CVE-2025-22891 [HIGH] CWE-772 CVE-2025-22891: When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-54854P3HIGHCVSS 7.5≥ 17.5.0, < 17.5.1.3≥ 17.1.0, < 17.1.3+2 more2025-10-15

CVE-2025-54854 [HIGH] CWE-125 CVE-2025-54854: When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtu When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-61960P3HIGHCVSS 7.5≥ 17.5.0, < 17.5.1.3≥ 17.1.0, < 17.1.3+1 more2025-10-15

CVE-2025-61960 [HIGH] CWE-476 CVE-2025-61960: When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed tr When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-46405P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2.2≥ 16.1.0, < 16.1.6+1 more2025-08-13

CVE-2025-46405 [HIGH] CWE-121 CVE-2025-46405: When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-52585P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.2.2≥ 16.1.0, < 16.1.6+1 more2025-08-13

CVE-2025-52585 [HIGH] CWE-476 CVE-2025-52585: When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enable When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-40629P3HIGHCVSS 7.5≥ 17.5.0, < 17.5.1.4≥ 17.1.0, < 17.1.3.1+1 more2026-05-13

CVE-2026-40629 [HIGH] CWE-770 CVE-2026-40629: When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual serv When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-40618P3HIGHCVSS 7.5≥ 21.0.0, < 21.0.0.1≥ 17.5.0, < 17.1.5.4+2 more2026-05-13

CVE-2026-40618 [HIGH] CWE-131 CVE-2026-40618: When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel Q When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reache

nvd

CVE-2026-40423P3HIGHCVSS 7.5≥ 21.0.0, < 21.0.0.2≥ 17.5.0, < 17.5.1.6+2 more2026-05-13

CVE-2026-40423 [HIGH] CWE-770 CVE-2026-40423: When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Mana When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-42920P3HIGHCVSS 7.5≥ 21.0.0, < 21.0.0.1≥ 17.5.0, < 17.5.1.4+2 more2026-05-13

CVE-2026-42920 [HIGH] CWE-835 CVE-2026-42920: When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, un When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-61951P3HIGHCVSS 7.5≥ 17.5.0, < 17.5.1≥ 17.1.0, < 17.1.3+1 more2025-10-15

CVE-2025-61951 [HIGH] CWE-125 CVE-2025-61951: Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authent

nvd

CVE-2022-28716P3HIGHCVSS 8.8v12.1.xv11.6.x+4 more2022-05-05

CVE-2022-28716 [HIGH] CWE-79 CVE-2022-28716: On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14 On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP AFM, CGNAT, and PEM Configuration utility that allows an attacker to execute Java

nvd

CVE-2022-27189P3HIGHCVSS 7.5v12.1.xv11.6.x+4 more2022-05-05

CVE-2022-27189 [HIGH] CWE-681 CVE-2022-27189: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions p On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol (ICAP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Micr

nvd

CVE-2022-34655P3HIGHCVSS 7.5≥ 14.1.x, < 14.1.5≥ 15.1.x, < 15.1.6.1+1 more2022-08-04

CVE-2022-34655 [HIGH] CWE-457 CVE-2022-34655: In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-34651P3HIGHCVSS 7.5≥ 15.1.x, < 15.1.6.1≥ 16.1.x, < 16.1.3.12022-08-04

CVE-2022-34651 [HIGH] CWE-476 CVE-2022-34651: In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server S In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Tech

nvd

CVE-2023-40534P3HIGHCVSS 7.5≥ 17.1.0, < 17.1.0.3.0.23.4-ENG≥ 16.1.0, < 16.1.4.1.0.13.5-ENG2023-10-10

CVE-2023-40534 [HIGH] CWE-401 CVE-2023-40534: When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, a When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2023-22422P3HIGHCVSS 7.5≥ 17.0.0, < 17.0.0.2≥ 16.1.0, < 16.1.3.32023-02-01

CVE-2023-22422 [HIGH] CWE-120 CVE-2023-22422: On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the n On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached En

nvd

CVE-2022-32455P3HIGHCVSS 7.5≥ 13.1.0, < *≥ 14.1.0, < 14.1.5+2 more2022-08-04

CVE-2022-32455 [HIGH] CWE-119 CVE-2022-32455: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all ver In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: So

nvd

← Previous4 / 14Next →