BA
Product
Big-ip Access Policy Manager
On CISA KEVExploited in the wildRansomware-linked
629
CVEs
13
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 40High 333Medium 127Low 0
Watch
Add Big-ip Access Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24320 | 8.0 | Feb 5 | BIG-IP Configuration utility vulnerability Affected: 15.1.0 before 15.1.10.6; 16.1.0 before 16.1.5.2; 17.1.0 before 17.1.2 |
| CVE-2024-31156 | 8.0 | May 8 | BIG-IP Configuration utility XSS vulnerability Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3 |
| CVE-2026-41217 | 7.9 | May 13 | BIG-IP tmsh vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2023-5450 | 7.8 | Oct 10 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation… Affected: 7.2.3 before 7.2.4.5; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.10; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2023-43611 | 7.8 | Oct 10 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix… Affected: 7.2.3 before 7.2.4.4; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2023-38418 | 7.8 | Aug 2 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.9; 16.1.0 through 16.1.3; 17.0.0 through 17.1.0 |
| CVE-2023-22358 | 7.8 | Feb 1 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer Affected: 7.2.2 before 7.2.3.1; 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.8; 16.1.0 through 16.1.3; 17.0.0 before 17.0.0.2 |
| CVE-2022-28714 | 7.8 | May 5 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
| CVE-2022-29263 | 7.8 | May 5 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of… Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more |
| CVE-2021-23022 | 7.8 | Jun 10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.6 |
| CVE-2021-23023 | 7.8 | Jun 10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer Affected: 7.1.6 through 7.1.9.9; 7.2.1 before 7.2.1.3 |
| CVE-2021-22980 | 7.8 | Feb 12 | In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client… Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.6; 14.1.0 through 14.1.3; 15.1.0 through 15.1.2; 16.0.0 before 16.0.1.1 |
| CVE-2020-5896 | 7.8 | May 12 | On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions Affected: 11.6.1 through 11.6.5.1; 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.5; 15.0.0 through 15.1.0.3 |
| CVE-2020-5858 | 7.8 | Mar 27 | On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles… Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3; 14.1.0 through 14.1.2; 15.0.0 through 15.0.1 |
| CVE-2019-6685 | 7.8 | Dec 23 | On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules… Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.2; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.2.3; 15.0.0 before 15.1.0 |
| CVE-2019-9075 | 7.8 | Feb 24 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32 Affected: 14.1.0; 15.0.0 |
| CVE-2018-5546 | 7.8 | Aug 17 | The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to… Affected: 12.1.0 through 12.1.3 |
| CVE-2018-5529 | 7.8 | Jul 12 | The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an unprivileged user to assume super-user… Affected: 7.1.5 through 7.1.6.1; 11.5.1 through 11.5.6; 12.1.0 through 12.1.3; 13.0.0 through 13.1.0 |
| CVE-2018-13405 | 7.8 | Jul 6 | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory… Affected: 13.0.0 before 13.1.3.5; 14.0.0 before 14.1.3.1; 15.0.0 before 15.0.1.4; 15.1.0; 16.0.0 |
| CVE-2022-31473 | 7.7 | Aug 4 | BIG-IP APM Appliance mode vulnerability CVE-2022-31473 Affected: 15.1.0 before 15.1.4; 16.1.0 |
| CVE-2024-3661 | 7.6 | May 6 | DHCP routing options can manipulate interface-based VPN traffic Affected: 7.2.3 through 7.2.5; 15.1.0 through 15.1.10; 16.1.0 through 16.1.5; 17.1.0 through 17.1.2 |
| CVE-2017-0301 | 7.6 | Dec 21 | In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the… Affected: 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; +5 more |
| CVE-2026-40423 | 7.5 | May 13 | BIG-IP SIP profile vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-39458 | 7.5 | May 13 | BIG-IP DNS Cache vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-39455 | 7.5 | May 13 | BIG-IP Configuration utility vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-42409 | 7.5 | May 13 | BIG-IP HTTP/2 vulnerability Affected: 21.0.0; 16.1.0 through 16.1.6; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2026-40618 | 7.5 | May 13 | BIG-IP SSL/TLS vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-41956 | 7.5 | May 13 | BIG-IP TMM Vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-42920 | 7.5 | May 13 | BIG-IP DTLS Vulnerability Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-40629 | 7.5 | May 13 | BIG-IP SSL/TLS vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6 |
| CVE-2026-41218 | 7.5 | May 13 | BIG-IP PEM iRules vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2026-40067 | 7.5 | May 13 | BIG-IP APM Vulnerability Affected: 16.1.0 through 16.1.6; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 21.0.0 |
| CVE-2025-61990 | 7.5 | Oct 15 | TMM vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3 |
| CVE-2025-58071 | 7.5 | Oct 15 | BIG-IP IPSec vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 |
| CVE-2025-61960 | 7.5 | Oct 15 | BIG-IP APM portal access vulnerability Affected: 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3 |
| CVE-2025-54854 | 7.5 | Oct 15 | BigIP APM Vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-58096 | 7.5 | Oct 15 | BIG-IP TMM vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-61951 | 7.5 | Oct 15 | BIG-IP DTLS 1.2 Vulnerability Affected: 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 |
| CVE-2025-53856 | 7.5 | Oct 15 | TMM vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-59781 | 7.5 | Oct 15 | BIG-IP DNS cache vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-46706 | 7.5 | Oct 15 | BIG-IP iRules vulnerability Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-48008 | 7.5 | Oct 15 | BIG-IP MPTCP vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6 |
| CVE-2025-53474 | 7.5 | Oct 15 | BIG-IP iRules vulnerability Affected: 15.1.0 before 15.1.1.0.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1 |
| CVE-2025-46405 | 7.5 | Aug 13 | BIG-IP APM vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-52585 | 7.5 | Aug 13 | BIG-IP Client SSL profile vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-41431 | 7.5 | May 7 | TMM Vulnerability Affected: 17.1.2 |
| CVE-2025-36525 | 7.5 | May 7 | BIG-IP APM PingAccess Virtual Server Vulnerability Affected: 15.1.0 before 15.1.10.7.0.4.5; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2 |
| CVE-2025-36504 | 7.5 | May 7 | BIG-IP HTTP/2 vulnerability Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2 |
| CVE-2025-41414 | 7.5 | May 7 | BIG-IP HTTP/2 vulnerability Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2 |
| CVE-2025-41433 | 7.5 | May 7 | BIG-IP SIP ALG profile vulnerability Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2 |
The 500 most important CVEs for this product (exploited first, then by severity)