F5
Vulnerability activity for F5: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 6
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Last 365 days
- CVEs
- 34
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 2
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalSep 22, 2026F5 BIG-IP APM Memory corruptionCVE-2026-94127Affected: F5 BIG-IP Application Security Manager (ASM) and Access Policy Manager (APM) modules. Attacker gains: Remote code execution and system compromise. Recommended action: Immediately apply the latest available patches or hotfixes provided by F5 for the affected modules.Added to KEV Sep 22, 2026Exploited2.2% likelyDetection
- 9.8CriticalMar 27, 2026F5 BIG-IP Memory corruptionCVE-2025-53521(1) F5 BIG-IP Application Services Manager and other BIG-IP products are affected. (2) An attacker gains remote code execution and potentially full control over the system. (3) Apply F5 BIG-IP Security Advisory 53521 and ensure all recommended patches are installed.Added to KEV Mar 27, 2026Exploited2.3% likely
- 9.8CriticalOct 26, 2023F5 BIG-IP Configuration Utility Auth bypass / access controlCVE-2023-46747(1) F5 BIG-IP Configuration Utility is affected. (2) An attacker gains administrative access to the BIG-IP system. (3) Update to version 16.1.0.1 or later and apply the necessary configuration changes.Added to KEV Oct 31, 2023 · 4 days after publicationExploited97% likelyExploit codeMetasploit · NucleiDetection
- 8.8HighOct 26, 2023F5 BIG-IP Configuration Utility SQL injectionCVE-2023-46748BIG-IP Configuration Utility. An attacker gains remote code execution and potentially sensitive information. Patch BIG-IP Configuration Utility to the latest version.Added to KEV Oct 31, 2023 · 4 days after publicationExploited4.2% likely
- 9.8CriticalMay 5, 2022F5 BIG-IP Auth bypass / access controlCVE-2022-1388F5 BIG-IP iControl REST interface. An attacker gains remote code execution. Patch F5 BIG-IP to version 14.1.0.5 or later.Added to KEV May 10, 2022 · 4 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalMar 31, 2021F5 BIG-IP Traffic Management Microkernel Memory corruptionCVE-2021-22991BIG-IP Traffic Management Microkernel. An attacker gains remote code execution. Update BIG-IP to version 16.1.0.3 or later.Added to KEV Jan 18, 2022 · 292 days after publicationExploited61% likelyDetection
- 9.8CriticalMar 31, 2021F5 BIG-IP and BIG-IQ Centralized Management Auth bypass / access controlCVE-2021-22986Affected: F5 BIG-IP and BIG-IQ Centralized Management iControl REST. Attacker gains: Remote code execution and potentially full control of the system. Recommended action: Apply F5 BIG-IP and BIG-IQ Centralized Management iControl REST patch version 17.0.0-HF2 or later.Added to KEV Nov 3, 2021 · 216 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalJul 1, 2020F5 BIG-IP Path traversal / file handlingCVE-2020-5902Affected: F5 BIG-IP Traffic Management User Interface (TMUI) Attacker gains: Remote code execution Recommended action: Patch to version 14.1.0.7 or later.Added to KEV Nov 3, 2021 · 490 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Recent
- 7.5HighOct 14, 2026F5 NGINX Ingress ControllerCVE-2026-104939Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authenticati
- 6.5MediumOct 14, 2026F5 NGINX JavaScriptCVE-2026-101019Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an expl
- 8.1HighOct 14, 2026F5 NGINX Plus Memory corruptionCVE-2026-93479A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cac
- 8.1HighOct 14, 2026F5 NGINX Plus Memory corruptionCVE-2026-15176A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable
- 9.8CriticalSep 22, 2026F5 BIG-IP APM Memory corruptionCVE-2026-94127Affected: F5 BIG-IP Application Security Manager (ASM) and Access Policy Manager (APM) modules. Attacker gains: Remote code execution and system compromise. Recommended action: Immediately apply the latest available patches or hotfixes provided by F5 for the affected modules.Exploited2.2% likelyDetection
- 8.8HighSep 2, 2026F5 BIG-IP SSRFCVE-2026-66842Affected: BIG-IP Traffic Management User Interface (TMUI) Attacker gains: Ability to create administrative user accounts Recommended action: Update BIG-IP software to the latest version.
- 8.7HighMay 13, 2026F5 big-ip access policy manager Code / command injectionCVE-2026-41953BIG-IP systems are affected. An attacker gains elevated privileges and can modify configuration objects. Update to a supported BIG-IP version or apply a patch to mitigate this vulnerability.
- 7.5HighMay 13, 2026F5 big-ip advanced web application firewall Denial of serviceCVE-2026-41227On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 9.1CriticalMay 13, 2026F5 big-ip access policy managerCVE-2026-41225iControl REST API. An attacker gains arbitrary command execution. Patch the iControl REST API to a supported version.
- 6.5MediumMay 13, 2026F5 big-ip access policy manager Information disclosureCVE-2026-41219An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- 7.5HighMay 13, 2026F5 big-ip access policy manager Memory corruptionCVE-2026-41218When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.9HighMay 13, 2026F5 big-ip access policy manager Privilege escalationCVE-2026-41217A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 5.4MediumMay 13, 2026F5 big-ip access policy manager CSRFCVE-2026-40703A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 4.8MediumMay 13, 2026F5 dos Memory corruptionCVE-2026-40701NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or
- 6.5MediumMay 13, 2026F5 big-ip access policy manager Information disclosureCVE-2026-40699A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.7HighMay 13, 2026F5 big-ip access policy manager Code / command injectionCVE-2026-40698A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.7HighMay 13, 2026F5 big-ip access policy manager Path traversal / file handlingCVE-2026-40631An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip access policy manager Denial of serviceCVE-2026-40629When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip access policy manager Memory corruptionCVE-2026-40618When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 6.5MediumMay 13, 2026F5 big-ip access policy manager Privilege escalationCVE-2026-40462Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 6.5MediumMay 13, 2026F5 dos Auth bypass / access controlCVE-2026-40460When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 5.3MediumMay 13, 2026F5 big-ip access policy managerCVE-2026-40435When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip access policy manager Denial of serviceCVE-2026-40423When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip access policy manager Memory corruptionCVE-2026-40067When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.7HighMay 13, 2026F5 big-ip domain name system Code / command injectionCVE-2026-40061When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip application security managerCVE-2026-40060When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.2HighMay 13, 2026F5 big-ip access policy manager Privilege escalationCVE-2026-39459A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.5HighMay 13, 2026F5 big-ip access policy manager Denial of serviceCVE-2026-39458When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.7HighMay 13, 2026F5 big-ip access policy manager Privilege escalationCVE-2026-32673A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.7HighMay 13, 2026F5 big-ip access policy manager Privilege escalationCVE-2026-32643A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 4.4MediumMay 13, 2026F5 big-ip domain name system Information disclosureCVE-2026-28758When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- 6.8MediumMay 13, 2026F5 big-ip access policy manager Path traversal / file handlingCVE-2026-24464When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 8.1HighMay 13, 2026F5 big-iq centralized management Path traversal / file handlingCVE-2026-20916An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 9.8CriticalMar 27, 2026F5 BIG-IP Memory corruptionCVE-2025-53521(1) F5 BIG-IP Application Services Manager and other BIG-IP products are affected. (2) An attacker gains remote code execution and potentially full control over the system. (3) Apply F5 BIG-IP Security Advisory 53521 and ensure all recommended patches are installed.Exploited2.3% likely
- 8.8HighOct 26, 2023F5 BIG-IP Configuration Utility SQL injectionCVE-2023-46748BIG-IP Configuration Utility. An attacker gains remote code execution and potentially sensitive information. Patch BIG-IP Configuration Utility to the latest version.Exploited4.2% likely
- 9.8CriticalOct 26, 2023F5 BIG-IP Configuration Utility Auth bypass / access controlCVE-2023-46747(1) F5 BIG-IP Configuration Utility is affected. (2) An attacker gains administrative access to the BIG-IP system. (3) Update to version 16.1.0.1 or later and apply the necessary configuration changes.Exploited97% likelyExploit codeMetasploit · NucleiDetection
- 7.5HighFeb 1, 2023F5 big-ip domain name system Memory corruptionCVE-2023-22839On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 9.8CriticalMay 5, 2022F5 BIG-IP Auth bypass / access controlCVE-2022-1388F5 BIG-IP iControl REST interface. An attacker gains remote code execution. Patch F5 BIG-IP to version 14.1.0.5 or later.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalMar 31, 2021F5 BIG-IP Traffic Management Microkernel Memory corruptionCVE-2021-22991BIG-IP Traffic Management Microkernel. An attacker gains remote code execution. Update BIG-IP to version 16.1.0.3 or later.Exploited61% likelyDetection
- 9.8CriticalJul 1, 2020F5 BIG-IP Path traversal / file handlingCVE-2020-5902Affected: F5 BIG-IP Traffic Management User Interface (TMUI) Attacker gains: Remote code execution Recommended action: Patch to version 14.1.0.7 or later.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalMar 31, 2021F5 BIG-IP and BIG-IQ Centralized Management Auth bypass / access controlCVE-2021-22986Affected: F5 BIG-IP and BIG-IQ Centralized Management iControl REST. Attacker gains: Remote code execution and potentially full control of the system. Recommended action: Apply F5 BIG-IP and BIG-IQ Centralized Management iControl REST patch version 17.0.0-HF2 or later.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Top products
- big-ip access policy manager20 CVEs in the last year, 1 critical
- NGINX Plus2 CVEs in the last year
- dos2 CVEs in the last year
- big-ip domain name system2 CVEs in the last year
- BIG-IP2 CVEs in the last year, 1 critical, 1 exploited
- NGINX JavaScript1 CVE in the last year
- NGINX Ingress Controller1 CVE in the last year
- big-iq centralized management1 CVE in the last year
- big-ip application security manager1 CVE in the last year
- BIG-IP APM1 CVE in the last year, 1 critical, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- oss-security · Oct 23, 2026nginx RCEs CVE-2026-93479, CVE-2026-15176CVE-2026-15176CVE-2026-93479
- CCCS (Canada) · Oct 15, 2026F5 security advisory (AV26-1049)CVE-2026-101019CVE-2026-104939CVE-2026-15176
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.