Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 552

Export CSV
CVE-2025-31644

Appliance mode BIG-IP iControl REST and tmsh vulnerability

When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.5 High EPSS 24.3% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-40423

BIG-IP SIP profile vulnerability

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-63020

BIG-IP Configuration utility vulnerability

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-39458

BIG-IP DNS Cache vulnerability

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2026-40629

BIG-IP SSL/TLS vulnerability

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 24 more
CVE-2026-41956

BIG-IP TMM Vulnerability

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more
CVE-2026-40618

BIG-IP SSL/TLS vulnerability

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 24 more
CVE-2026-42409

BIG-IP HTTP/2 vulnerability

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 23 more
CVE-2026-42058

BIG-IP iControl REST vulnerability

An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-34176

Knowledge Appliance mode iControl REST vulnerability

When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-42920

BIG-IP DTLS Vulnerability

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-42781

BIG-IP FastL4 virtual server vulnerability

When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-41957

BIG-IP and BIG-IQ Configuration utility vulnerability

An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 21 more
CVE-2026-41218

BIG-IP PEM iRules vulnerability

When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-42063

iControl SOAP vulnerability

A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-40699

BIG-IP Configuration utility vulnerability

A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2026-40631

BIG-IP iControl SOAP vulnerability

An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more