Read the docs

F5

Records1058All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical89CVSS 9.0–10.0
CVSS high585CVSS 7.0–8.9

Exploited now

F5 records in CISA KEV
TI-2026-63338 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability Priority CRITICAL 99KEV 2026-09-22TI-2025-33465 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability Priority CRITICAL 99KEV 2026-03-27TI-2018-10499 Linux Kernel Integer Overflow Vulnerability Priority CRITICAL 93KEV 2026-01-26TI-2023-25230 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2023-10-31TI-2023-25231 F5 BIG-IP Configuration Utility SQL Injection Vulnerability Priority CRITICAL 97KEV 2023-10-31TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10

Components

Products in the NVD configurations · select one to filter the records
Big-ip Access Policy Manager 630 records CRITICAL Big-ip Application Security Manager 581 records CRITICAL Big-ip Advanced Firewall Manager 552 records CRITICAL Big-ip Local Traffic Manager 541 records CRITICAL Big-ip Policy Enforcement Manager 533 records CRITICAL Big-ip Link Controller 525 records CRITICAL Big-ip Application Acceleration Manager 524 records CRITICAL Big-ip Analytics 511 records CRITICAL

Records

20 records in Big-ip Access Policy Manager Client · all components

TI-2020-04815 CVE-2020-5897 · GHSA-r3g8-jcj5-f35g

Use after free in F5 Edge Client

Priority MEDIUM 41

In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01232 Published 2020-05-12 No fix listed CWE-416
TI-2023-23104 CVE-2023-43125 · GHSA-w439-f952-rj94

BIG-IP APM Clients TunnelCrack vulnerability

Priority LOW 37

BIG-IP APM clients may send IP traffic outside of the VPN tunnel.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00279 Published 2023-09-27 No fix listed CWE-319
TI-2024-19079 CVE-2024-28883 · GHSA-w6q8-c6q3-jvxr

BIG-IP APM browser network access VPN client vulnerability

Priority LOW 34

An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00205 Published 2024-05-08 Fixed in 7.2.4.4, 17.1.1 +2 CWE-346
TI-2022-11356 CVE-2022-28714 · GHSA-cjcv-g54m-pc49

Uncontrolled search path in F5 BIG-IP APM

Priority LOW 34

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM C…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.003 Published 2022-05-05 Fixed in 17.0.0, 16.1.2.2 +4 CWE-427
TI-2020-04814 CVE-2020-5896 · GHSA-wq94-3874-qv2h

Incorrect default permissions in F5 Edge Client

Priority LOW 34

On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.003 Published 2020-05-12 No fix listed CWE-276
TI-2018-04052 CVE-2018-5547 · GHSA-m3rp-fqh4-whc7

Missing authorization in F5 BIG-IP APM client for Windows

Priority LOW 34

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00262 Published 2018-08-17 No fix listed CWE-862
TI-2018-04051 CVE-2018-5546 · GHSA-825g-8x8x-f7wm

Incorrect permission assignment in F5 BIG-IP APM client for Linux

Priority LOW 34

The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00453 Published 2018-08-17 No fix listed CWE-732
TI-2021-05881 CVE-2021-23022 · GHSA-8x5p-wwwg-6587

Incorrect permission assignment in Edge Client for Windows

Priority LOW 33

On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00228 Published 2021-06-10 No fix listed CWE-732
TI-2025-30779 CVE-2025-48500 · GHSA-562w-w6qf-mvxf

BIG-IP APM VPN web client for macOS vulnerability

Priority LOW 32

A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package inst…

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00125 Published 2025-08-13 Fixed in 7.2.5.3 CWE-353
TI-2018-10908 CVE-2018-15332 · GHSA-pqqq-8453-mph5

Race condition in F5 BIG-IP , BIG-IP APM Clients, BIG-IP Edge Client

Priority LOW 31

The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host…

CVSS 3.0HIGH 7.0 Local Low privileges No interaction EPSS 0.00319 Published 2018-12-06 No fix listed CWE-362
TI-2023-23103 CVE-2023-43124 · GHSA-j87c-5cr6-p64r

BIG-IP APM Clients TunnelCrack vulnerability

Priority LOW 30

BIG-IP APM clients may send IP traffic outside of the VPN tunnel.

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00172 Published 2023-09-27 No fix listed CWE-319
TI-2022-10617 CVE-2022-27636 · GHSA-5f82-gg87-w4x9

Sensitive information in log files in F5 BIG-IP APM

Priority LOW 24

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM C…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00233 Published 2022-05-05 Fixed in 17.0.0, 16.1.2.2 +4 CWE-532
TI-2022-07206 CVE-2022-23032 · GHSA-m6rx-82hw-rv4g

Origin validation error in BIG-IP Edge Client for Mac and Windows

Priority LOW 24

In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00404 Published 2022-01-25 Fixed in 7.2.1.4 CWE-346
TI-2020-04811 CVE-2020-5893 · GHSA-5f6r-4wq3-8vp5

Cleartext transmission of sensitive information in BIG-IP Edge Client

Priority LOW 18

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00575 Published 2020-04-30 No fix listed CWE-319
TI-2026-16776 CVE-2026-20730 · GHSA-w766-9fv5-g368

BIG-IP Edge Client for Windows vulnerability

Priority LOW 10

A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00119 Published 2026-02-04 Fixed in 7.2.6.2 CWE-200
Open these records in search →