TI-2024-17123 CVE-2024-26026 · GHSA-fj43-9cjj-qw2v
BIG-IP Central Manager SQL Injection
Priority MEDIUM 49
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).
F5
Records1058All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical89CVSS 9.0–10.0
CVSS high585CVSS 7.0–8.9
Exploited now
F5 records in CISA KEVTI-2026-63338 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability TI-2025-33465 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability TI-2018-10499 Linux Kernel Integer Overflow Vulnerability TI-2023-25230 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability TI-2023-25231 F5 BIG-IP Configuration Utility SQL Injection Vulnerability TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Big-ip Next Central Manager · all components
TI-2024-14474 CVE-2024-21793 · GHSA-w9q2-p57h-r357
BIG-IP Central Manager OData Injection Vulnerability
Priority MEDIUM 49
An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).
TI-2025-27574 CVE-2025-41399 · GHSA-2ppg-9297-h3vc
SCTP Vulnerability
Priority MEDIUM 44
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
TI-2025-24852 CVE-2025-36504 · GHSA-x2q2-p7cx-c4pf
BIG-IP HTTP/2 vulnerability
Priority MEDIUM 44
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.
TI-2024-26726 CVE-2024-39809 · GHSA-pvj4-5rhw-5cww
BIG-IP Next Central Manager vulnerability
Priority MEDIUM 41
The Central Manager user session refresh token does not expire when a user logs out.
TI-2025-34296 CVE-2025-54500 · GHSA-q678-fxj6-jj99
HTTP/2 Vulnerability
Priority LOW 37
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).
TI-2024-21139 CVE-2024-32049 · GHSA-7grh-8hh5-88pf
BIG-IP Next Central Manager vulnerability
Priority LOW 35
BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.
TI-2024-24568 CVE-2024-37028 · GHSA-9pmg-927m-mm79
BIG-IP Next Central Manager vulnerability
Priority LOW 34
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.
TI-2024-22198 CVE-2024-33612 · GHSA-4wj3-7p36-wmrw
BIG-IP Next Central Manager vulnerability
Priority LOW 32
An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system.
TI-2025-18064 CVE-2025-24319 · GHSA-p97f-5rgg-7g94
BIG-IP Next Central Manager vulnerability
Priority LOW 31
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate.
TI-2025-17180 CVE-2025-23413 · GHSA-vjw2-gg68-3j52
BIG-IP Next Central Manager vulnerability
Priority LOW 29
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.
TI-2024-27778 CVE-2024-41719 · GHSA-wrw4-qghx-vfxm
BIG-IP Next Central Manager vulnerability
Priority LOW 22
When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs.