F5 BIG-IP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
166 matching records
- High8.7When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate.Check if you run itEPSS 0.95%Mar 24, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: tracing: Do not register unsupported perf events Synthetic events currently do not have a function to register pCheck if you run itEPSS 0.16%Jan 14, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: iavf: fix off-by-one issues in iavf_config_rss_reg() There are off-by-one bugs when configuring RSS hash key andCheck if you run itEPSS 0.14%Jan 13, 2026
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaksCheck if you run itEPSS 0.56%Dec 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: f2fs: Fix system crash due to lack of free space in LFS When f2fs tries to checkpoint during foreground gc in LFCheck if you run itEPSS 0.15%Dec 24, 2025
- High8.7A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation.Check if you run itEPSS 0.43%Dec 17, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently frCheck if you run itEPSS 0.16%Dec 4, 2025
- High8.7When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.Check if you run itEPSS 0.35%Oct 15, 2025
- High8.5A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges.Check if you run itEPSS 0.21%Oct 15, 2025
- Medium5.1A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-outCheck if you run itEPSS 0.20%Oct 15, 2025
- High8.7When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.Check if you run itEPSS 0.35%Oct 15, 2025
- High8.7When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.Check if you run itEPSS 0.37%Oct 15, 2025
- Medium5.6A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries sCheck if you run itEPSS 0.12%Oct 15, 2025
- Medium6.9An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.Check if you run itEPSS 0.21%Oct 15, 2025
- High8.7When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.Check if you run itEPSS 0.46%Oct 15, 2025
- High8.5A validation vulnerability exists in an undisclosed URL in the Configuration utility.Check if you run itEPSS 0.37%Oct 15, 2025
- Medium6.9A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files.Check if you run itEPSS 1.19%Oct 15, 2025
- High8.7When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.Check if you run itEPSS 0.35%Oct 15, 2025
- High8.5A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to exCheck if you run itEPSS 0.39%Oct 15, 2025
- High8.5A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to aCheck if you run itEPSS 0.39%Oct 15, 2025
- High8.5A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.Check if you run itEPSS 0.25%Oct 15, 2025
- High8.7When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.Check if you run itEPSS 0.35%Oct 15, 2025
- High8.2When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management MicrokernelCheck if you run itEPSS 0.35%Oct 15, 2025
- High8.7When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.Check if you run itEPSS 0.35%Oct 15, 2025
- High8.7When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtualCheck if you run itEPSS 0.35%Oct 15, 2025