Login Request a demo
BA
Product
Big-ip Advanced Web Application Firewall
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wildRansomware-linked
195
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities195In the news0Timeline
Severity mix
Critical 10High 119Medium 63Low 3
Severity
All severities195Critical10High119Medium63Low3
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Big-ip Advanced Web Application Firewall to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42920
7.5
0%
May 13
BIG-IP DTLS Vulnerability
Affected: 21.0.0; 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-40629
7.5
0%
May 13
BIG-IP SSL/TLS vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2026-41218
7.5
0%
May 13
BIG-IP PEM iRules vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0
CVE-2025-61990
7.5
0%
Oct 15
TMM vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3
CVE-2025-58071
7.5
0%
Oct 15
BIG-IP IPSec vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0
CVE-2025-61935
7.5
0%
Oct 15
BIG-IP Advanced WAF and ASM vulnerability
Affected: 15.1.0 before 15.1.10.8; 17.1.0 before 17.1.3; 17.5.0
CVE-2025-58096
7.5
0%
Oct 15
BIG-IP TMM vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-54858
7.5
0%
Oct 15
BIG-IP Advanced WAF and ASM vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.3
CVE-2025-61951
7.5
0%
Oct 15
BIG-IP DTLS 1.2 Vulnerability
Affected: 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0
CVE-2025-53856
7.5
0%
Oct 15
TMM vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-61938
7.5
0%
Oct 15
BIG-IP Advanced WAF and ASM bd process vulnerability
Affected: 17.1.0 before 17.1.3; 17.5.0
CVE-2025-59781
7.5
0%
Oct 15
BIG-IP DNS cache vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2
CVE-2025-46706
7.5
0%
Oct 15
BIG-IP iRules vulnerability
Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2
CVE-2025-48008
7.5
0%
Oct 15
BIG-IP MPTCP vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6
CVE-2025-53474
7.5
0%
Oct 15
BIG-IP iRules vulnerability
Affected: 15.1.0 before 15.1.1.0.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-52585
7.5
0%
Aug 13
BIG-IP Client SSL profile vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2.2
CVE-2025-36504
7.5
0%
May 7
BIG-IP HTTP/2 vulnerability
Affected: 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-41414
7.5
0%
May 7
BIG-IP HTTP/2 vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2025-41433
7.5
0%
May 7
BIG-IP SIP ALG profile vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2025-41399
7.5
0%
May 7
SCTP Vulnerability
Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0
CVE-2025-20045
7.5
0%
Feb 5
BIG-IP SIP MRF Vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.5; 17.1.0 before 17.1.2
CVE-2025-20058
7.5
0%
Feb 5
BIG-IP message routing vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-21091
7.5
0%
Feb 5
BIG-IP SNMP vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2025-21087
7.5
0%
Feb 5
TMM Vulnerability
Affected: 15.1.0 through 15.1.10; 16.1.0 before 16.1.6; 17.1.0 before 17.1.2
CVE-2024-41727
7.5
0%
Aug 14
BIG-IP TMM vulnerability
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-41164
7.5
0%
Aug 14
BIG-IP MPTCP vulnerability
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-39778
7.5
0%
Aug 14
BIG-IP HSB vulnerability
Affected: 15.1.0 through 15.1.1; 16.1.0 before 16.1.5; 17.1.0
CVE-2024-25560
7.5
1%
May 8
TMM Vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.4; 17.1.0
CVE-2024-33608
7.5
1%
May 8
BIG-IP IPsec vulnerability
Affected: 17.1.0
CVE-2024-23805
7.5
1%
Feb 14
F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability
Affected: 15.1.0 before 15.1.10; 16.1.0 before 16.1.4; 17.1.0
CVE-2024-21789
7.5
1%
Feb 14
BIG-IP ASM and Advanced WAF vulnerability
Affected: 17.1.0 before 17.1.1
CVE-2024-23308
7.5
1%
Feb 14
BIG-IP Advanced WAF and ASM vulnerability
Affected: 17.1.0 before 17.1.1
CVE-2024-21849
7.5
1%
Feb 14
BIG-IP Websockets vulnerability
Affected: 16.1.0 before 16.1.4
CVE-2023-41085
7.5
1%
Oct 10
BIG-IP IPSEC vulnerability
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2023-40542
7.5
1%
Oct 10
BIG-IP TCP Profile vulnerability
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2023-40534
7.5
1%
Oct 10
BIG-IP HTTP/2 vulnerability
Affected: 16.1.0 before 16.1.4.1; 17.1.0
CVE-2023-29163
7.5
1%
May 3
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions…
Affected: 14.1.0 before 14.1.5.4; 15.1.0 before 15.1.8.2; 16.1.0 before 16.1.3.4; 17.0.0
CVE-2023-23552
7.5
2%
Feb 1
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM…
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.3; 15.1.0 before 15.1.8; 16.1.0 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2022-41836
7.5
1%
Oct 19
BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836
Affected: 15.1.0 before 15.1.7; 16.1.0 before 16.1.3.1; 17.0.0
CVE-2022-41691
7.5
1%
Oct 19
BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691
Affected: 14.1.0 before 14.1.5.2
CVE-2022-29491
7.5
1%
May 5
On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x,…
Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more
CVE-2022-26890
7.5
1%
May 5
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5,…
Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more
CVE-2022-23025
7.5
1%
Jan 25
On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server,…
Affected: 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.1.0 through 16.1.1
CVE-2002-20001
7.5
25%
Nov 11
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive…
Affected: 13.1.0 through 17.1.2; 17.5.0
CVE-2021-23030
7.5
1%
Sep 14
On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a…
Affected: 12.1.0 through 12.1.6; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.0.0 through 16.0.1.1
CVE-2021-23028
7.5
1%
Sep 14
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5…
Affected: 13.1.3.5 through 13.1.3.6; 14.1.3.1 through 14.1.4.1; 15.1.1 before 15.1.3.1; 16.0.1
CVE-2021-23036
7.5
1%
Sep 14
On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel…
Affected: 16.0.0 through 16.0.1
CVE-2021-23033
7.5
1%
Sep 14
On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a…
Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.4.1; 14.1.0 before 14.1.4.3; 15.1.0 before 15.1.3.1; 16.0.0 before 16.1.0
CVE-2021-23045
7.5
1%
Sep 14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple…
Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.4.1; 14.1.0 before 14.1.4.3; 15.1.0 before 15.1.3.1; 16.0.0 before 16.0.1.2
CVE-2021-23042
7.5
1%
Sep 14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a…
Affected: 12.1.0 before 12.1.6; 13.1.0 before 13.1.4; 14.1.0 before 14.1.4; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.2
Page 2 of 4 · 195 total
1234