F5 Big-Ip Access Policy Manager vulnerabilities
630 known vulnerabilities affecting f5/big-ip_access_policy_manager.
Total CVEs
630
CISA KEV
13
actively exploited
Public exploits
21
Exploited in wild
17
Severity breakdown
CRITICAL45HIGH339MEDIUM238LOW8
Vulnerabilities
Page 32 of 32
CVE-2018-15334P4MEDIUMCVSS 4.3≥ 11.5.1, ≤ 11.6.3≥ 12.1.0, ≤ 12.1.3+2 more2018-12-28
CVE-2018-15334 [MEDIUM] CWE-352 CVE-2018-15334: A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow atta
A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication.
nvd
CVE-2015-7759P4LOWCVSS 3.7v12.0.02016-01-12
CVE-2015-7759 [LOW] CWE-20 CVE-2015-7759: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP
BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets, related to Path MTU (PMTU) discovery.
nvd
CVE-2022-41983P4LOWCVSS 3.7≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, < 14.1.5.1+2 more2022-10-19
CVE-2022-41983 [LOW] CWE-319 CVE-2022-41983: On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.
nvd
CVE-2013-6024P4MEDIUMCVSS 4.4v10.1.0v10.2.4+5 more2014-02-10
CVE-2013-6024 [MEDIUM] CWE-200 CVE-2013-6024: The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10
The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.x, and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vectors.
nvd
CVE-2019-6679P4LOWCVSS 3.3≥ 11.5.9, ≤ 11.5.10≥ 11.6.4, < 11.6.5.1+5 more2019-12-23
CVE-2019-6679 [LOW] CWE-59 CVE-2019-6679: On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12
On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users with SCP access to overwrite certain configuration files that
nvd
CVE-2026-20730P4LOWCVSS 3.3≥ 16.1.0, ≤ 16.1.6≥ 17.1.0, < 17.1.3.1+2 more2026-02-04
CVE-2026-20730 [LOW] CWE-200 CVE-2026-20730: A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attac
A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
nvd
CVE-2026-63020P4LOWCVSS 3.1≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+1 more2026-09-02
CVE-2026-63020 [LOW] CWE-451 CVE-2026-63020: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacke
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BIG-IP users
into accessing malicious links and reflect a spoofed error message in
the victim's BIG-IP Configuration utility web browser session. This is a
control plane issue; the
nvd
CVE-2025-23415P4LOWCVSS 3.1≥ 15.1.0, < 15.1.10.6.0.11.6≥ 16.1.0, < 16.1.5+1 more2025-02-05
CVE-2025-23415 [LOW] CWE-345 CVE-2025-23415: An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy e
An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux.
Note: Software versions which have reached End of Technica
nvd
CVE-2019-11109P4MEDIUMCVSS 4.4≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-18
CVE-2019-11109 [MEDIUM] CVE-2019-11109: Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00
Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of service via local access.
nvd
CVE-2014-4027P4LOWCVSS 2.3≥ 11.1.0, ≤ 11.6.0v12.0.02014-06-23
CVE-2014-4027 [LOW] CWE-200 CVE-2014-4027: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.1
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
nvd
← Previous32 / 32