Big Ip Advanced Web Application Firewall
Monthly
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious traffic when an access policy is configured on a virtual server.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
BIG-IP Advanced WAF and ASM experience denial of service when processing specific requests under certain conditions, causing the bd process to terminate and disrupting security policy enforcement. An unauthenticated remote attacker can trigger this crash without user interaction, though exploitation requires specific timing and environmental factors. No patch is currently available for affected versions.
Big-Ip Access Policy Manager is affected by user interface (ui) misrepresentation of critical information (CVSS 3.1).
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
A remote, unauthenticated denial-of-service condition affects F5 BIG-IP Advanced WAF and Application Security Manager (ASM) when a security policy is configured and bound to a virtual server: a specially crafted, undisclosed request causes the bd process to terminate, disrupting the traffic-handling and enforcement functions associated with that policy. Exploitation requires only that a WAF/ASM policy be attached to the targeted virtual server (PR:N/UI:N, AV:N, AC:L) - virtual servers without an attached policy are not affected - and the resulting impact is limited to availability (C:N/I:N/A:H, assessed CVSS:3.1 base 7.5-equivalent for the DoS component; vendor scores 8.7 under CVSS 4.0). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is 0.35% (26th percentile), indicating low near-term exploitation likelihood.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
An authenticated attacker holding at least the resource administrator role on an F5 BIG-IP system can use the iHealth command to escape the tmsh restricted shell and obtain a full bash shell, a privilege escalation rated CVSS 4.0 8.5 (and CVSS 3.1 8.5, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). The impact is most severe on BIG-IP systems running in Appliance mode, where tmsh confinement is the enforced control and successful exploitation lets the attacker cross a security boundary; on systems not in Appliance mode the bash access is correspondingly less consequential. There is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low (0.39%, 31st percentile), making this an access-gated privilege-escalation issue rather than a mass-exploitation threat. Administered roles and the Appliance mode setting are the primary gating factors.
Undisclosed network traffic can crash the Traffic Management Microkernel (TMM) on F5 BIG-IP, the data-plane process responsible for handling all traffic on the device, resulting in a denial of service against the whole system. Exploitation requires a narrow, non-default configuration: a DTLS 1.2 virtual server with a Server SSL profile that has a certificate and key installed and the SSL Sign Hash set to ANY, plus a backend server enabled for DTLS 1.2 with client authentication; no authentication or user interaction is required against a device in that state, but other configurations are not affected. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is low at 0.24% (14th percentile), consistent with an availability-only flaw gated by a specific configuration rather than a broadly weaponizable one.
Denial of service in F5 BIG-IP Advanced WAF and BIG-IP ASM occurs when a Data Guard Protection Enforcement setting contains a URL longer than 1024 characters; the oversized input can cause the bd process to terminate repeatedly. Only deployments with a Data Guard-enabled WAF/ASM policy are affected-default BIG-IP configurations without such a policy are not exploitable-and the condition is introduced either manually by an administrator or automatically by Policy Builder learning an oversized URL from traffic. CVSS 4.0 score is 8.7 (availability-only, PR:N), while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit identified at time of analysis and EPSS is 0.35% (26th percentile); the provided Information Disclosure tag is inconsistent with the assessed availability-only impact.
Resource exhaustion in F5 BIG-IP and BIG-IP Next CNF DNS cache allows remote unauthenticated attackers to increase memory utilization on a DNS-caching virtual server, causing a high availability impact when malicious DNS queries are delivered. The flaw is only reachable when the non-default DNS cache feature is configured on a virtual server, and software versions past End of Technical Support were not evaluated. No public exploit was identified at time of analysis, CISA KEV status is not indicated, and EPSS is low at 0.35%.
Authenticated high-privilege users can exploit insufficient file path validation in the F5 BIG-IP Configuration utility to achieve high confidentiality and integrity impact within the management interface, though the flaw requires a network-reachable management session with elevated privileges. No public exploit code has been identified, and EPSS probability is low at 0.37% (29th percentile). The issue affects numerous BIG-IP modules as listed in the CPE, and End-of-Technical-Support versions were not evaluated, so unsupported builds cannot be assumed unaffected.
Privilege escalation in F5 BIG-IP lets an authenticated user who already holds at least the Resource Administrator role escalate to a higher privilege level by invoking an undisclosed iControl REST endpoint or TMOS Shell (tmsh) command that executes arbitrary operating-system commands, crossing a security boundary (scope changed, S:C). The flaw affects BIG-IP across essentially every licensed module (LTM, ASM, APM, AFM, Advanced WAF, Analytics, AVR, GTM, DNS, PEM, CGNAT, SSL Orchestrator, Container Ingress Services, and others) that share the underlying TMOS management plane; software versions past End of Technical Support were not evaluated by F5 and should be treated as potentially affected. Exploitation requires an authenticated session with administrative-tier access (PR:H), so the realistic attacker population is insiders or an adversary who has already compromised such an account - no public exploit code has been identified at time of analysis and EPSS is low (0.39%, 31st percentile), which is consistent with the high privilege prerequisite rather than a mass-exploitation scenario.
Stored cross-site scripting in the F5 BIG-IP Configuration utility lets an authenticated, high-privileged management user plant JavaScript that later executes in the browser session of any other administrator who loads the affected (undisclosed) page, enabling session-scoped data theft and privileged configuration actions under the victim's identity. Exploitation requires the attacker to already hold a privileged account on the management interface plus a second user to trigger the payload, and F5 hardening guidance assumes the Configuration utility is not internet-exposed. No public exploit code has been identified at time of analysis and EPSS is low at 0.28% (19th percentile), yet the vendor-assigned CVSS 4.0 base score of 8.4 (High) and the breadth of affected BIG-IP modules make this a meaningful risk for internet-reachable or weakly segmented management planes.
Unauthenticated remote attackers who can reach the BIG-IP Configuration utility (TMUI/management interface) can retrieve content from undisclosed endpoints that return static, non-sensitive information, resulting in a limited confidentiality exposure (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3, confidentiality-only, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.40% (33rd percentile), consistent with an information-disclosure issue whose practical risk is governed almost entirely by whether the management plane is exposed. The primary mitigation is F5's long-standing guidance to keep the Configuration utility on an isolated management network; organizations that do so have no general network reachability, making this a low-priority item despite the headline 6.9 score.
Denial of service in F5 BIG-IP Advanced WAF (the ASM module) and in NGINX with App Protect Bot Defense allows remote, unauthenticated attackers to disrupt new client requests by sending undisclosed specially crafted traffic through the inspection path. Only deployments that actively enable the affected feature are exposed - BIG-IP virtual servers with Server-Side Request Forgery (SSRF) protection turned on, or NGINX servers running App Protect Bot Defense - while impact is limited to availability, with no confidentiality or integrity effect. Risk is constrained by the low EPSS score (0.39%, 31st percentile) and there is no public exploit identified at time of analysis, but the low attack complexity and lack of required credentials mean exposed, feature-enabled edge devices should still be prioritized for patching.
Undisclosed crafted network traffic can corrupt or modify data handled by F5 BIG-IP when the affected flow uses a protocol that lacks message integrity protection, allowing an unauthenticated remote party to alter data without any confidentiality or availability impact. The issue affects BIG-IP broadly across the LTM, ASM/Advanced WAF, APM, AFM, GTM/DNS, CGNAT, Container Ingress Services and related module lines, and carries a CVSS 4.0 base score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VI:L), meaning exploitation is gated by attack prerequisites - the attacker must be able to inject traffic into a suitable integrity-less flow - rather than by authentication. Risk is moderate: EPSS is low at 0.25% (14th percentile), there is no KEV listing and no public exploit identified at time of analysis, so this is a hardening and integrity-assurance item rather than an emergency patch trigger.
Denial of service in F5 BIG-IP hardware platforms occurs when the High-Speed Bridge (HSB) locks up under specific undisclosed traffic conditions, though the trigger is non-deterministic and cannot be reliably forced by an attacker (high attack complexity). This affects BIG-IP hardware appliances containing HSB; software-only/virtual editions and End-of-Technical-Support versions are not affected. No authentication or user interaction is required, but no public exploit has been identified and EPSS score is 0.23% (low likelihood).
Denial of service in F5 BIG-IP's Traffic Management Microkernel (TMM) lets a remote, unauthenticated attacker crash the traffic-processing core by sending undisclosed crafted TCP/UDP traffic, but only on systems where the database variable tm.tcpudptxchecksum has been set to the non-default value 'Software-only'; default configurations are not affected. The root cause is a memory-corruption class defect (CWE-787, out-of-bounds write) in TMM's software checksum handling, rated 8.2 under the vendor's CVSS 4.0 vector, while independent assessment with CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) places it lower because the non-default checksum setting is a hard prerequisite (captured as AT:P in the 4.0 vector). EPSS is low (0.35%, 26th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Because TMM is shared across virtually every BIG-IP module, an affected appliance loses its data-plane forwarding capability each time TMM terminates.
Denial of service in F5 BIG-IP Advanced WAF and BIG-IP ASM can terminate the bd process when a Security Policy is bound to a virtual server and contains a JSON content profile whose JSON schema is malformed. Remote, unauthenticated attackers (CVSS 4.0 vector PR:N/UI:N, AV:N/AC:L) can send undisclosed requests that crash the process, producing an availability-only impact (VA:H with VC:N/VI:N) scored 8.7 by the vendor. Exploitation is gated by a non-default, erroneous configuration: only policies carrying a malformed JSON schema are affected, correctly formed JSON profiles and policies without JSON profiles are not, and End of Technical Support versions were not evaluated. EPSS is low at 0.35% (26th percentile), and there is no public exploit identified at time of analysis.
A directory traversal flaw in F5 BIG-IP's Traffic Management User Interface (TMUI) allows an already highly privileged, authenticated administrator of the management console to read files outside the intended directory scope on affected BIG-IP systems. The high-privilege prerequisite (PR:H in the vector) is the primary limiting factor: unauthenticated or low-privileged remote users cannot trigger the flaw, and the impact is confined to confidentiality (unauthorized file reads) with no stated integrity or availability effect. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation; EPSS sits at 1.19% (67th percentile), making this a moderate-priority hardening item rather than an emergency, though exposure rises if the TMUI management interface is internet-reachable or admin credentials are shared with lower-trust operators.
Appliance mode restrictions in F5 BIG-IP can be escaped by a highly privileged, authenticated administrator who already holds SCP and SFTP access to the device, allowing undisclosed commands to run outside the restricted shell that Appliance mode is designed to enforce. The flaw is a command-injection class issue (CWE-78) in the BIG-IP platform and affects the broad set of BIG-IP modules (APM, ASM/AWAF, AFM, Analytics, AAM, CGNAT, CIS, and others) only when the system is deliberately configured in Appliance mode - a non-default hardened lockdown state. Exploitation requires PR:H per the CVSS vector, meaning no unauthenticated or low-privileged path exists, and there is no public exploit identified at time of analysis; EPSS is low at 0.44% (37th percentile), and the CVE is not listed in CISA KEV. The net effect is a confidentiality and integrity impact (high C/I, no availability impact) for environments that tier a hardened Appliance-mode posture against trusted administrators.
Undisclosed network traffic can cause the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP devices that use the embedded Packet Velocity Acceleration (ePVA) feature on hardware containing an ePVA chip, resulting in a denial-of-service condition. This unauthenticated remote DoS (assessed CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects configurations using ePVA for virtual servers, NAT, or SNAT objects; devices without ePVA hardware or not using the feature are not exploitable. No public exploit identified at time of analysis, and the EPSS score is low (0.35%).
Remote unauthenticated attackers can cause a denial-of-service condition in F5 BIG-IP by sending undisclosed traffic to a virtual server configured with an iRule that uses the ILX::call command, resulting in termination of the Traffic Management Microkernel (TMM). This vulnerability, tracked as CVE-2025-53474, affects supported (non-EoTS) BIG-IP versions only when such a non-default iRule is present; devices without ILX::call-based iRules are not exploitable. No public exploit or active exploitation is known at time of analysis, and the EPSS score is low (0.35%, percentile 26%), though the CVSS 4.0 base score is 8.7 due to high availability impact.
A use-after-free (CWE-416) in F5 BIG-IP's Traffic Management Microkernel (TMM) allows remote unauthenticated attackers to crash the data-plane process when a TCP profile with Multipath TCP (MPTCP) explicitly enabled is applied to a virtual server. Only deployments with non-default MPTCP-enabled TCP profiles are exposed; successful triggering also depends on undisclosed traffic patterns and conditions beyond the attacker's control, so the crash cannot be forced reliably. Impact is availability-only (CVSS 4.0: 8.7, VA:H with VC:N/VI:N), no public exploit code or confirmed active exploitation is identified at time of analysis, and EPSS is low (~0.44%, 37th percentile).
Denial of service in F5 BIG-IP allows remote unauthenticated attackers to exhaust memory resources on virtual servers configured with an iRule containing the HTTP::respond command. The issue affects multiple BIG-IP modules and BIG-IP Next variants, excluding releases that have reached End of Technical Support, and successful exploitation only impacts availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and EPSS estimates a low exploitation likelihood of 0.43%.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authenticated attackers can inject system commands through crafted save operations, executing arbitrary code on the BIG-IP appliance which typically handles load balancing and SSL termination for critical application infrastructure.
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious traffic when an access policy is configured on a virtual server.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
BIG-IP Advanced WAF and ASM experience denial of service when processing specific requests under certain conditions, causing the bd process to terminate and disrupting security policy enforcement. An unauthenticated remote attacker can trigger this crash without user interaction, though exploitation requires specific timing and environmental factors. No patch is currently available for affected versions.
Big-Ip Access Policy Manager is affected by user interface (ui) misrepresentation of critical information (CVSS 3.1).
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
A remote, unauthenticated denial-of-service condition affects F5 BIG-IP Advanced WAF and Application Security Manager (ASM) when a security policy is configured and bound to a virtual server: a specially crafted, undisclosed request causes the bd process to terminate, disrupting the traffic-handling and enforcement functions associated with that policy. Exploitation requires only that a WAF/ASM policy be attached to the targeted virtual server (PR:N/UI:N, AV:N, AC:L) - virtual servers without an attached policy are not affected - and the resulting impact is limited to availability (C:N/I:N/A:H, assessed CVSS:3.1 base 7.5-equivalent for the DoS component; vendor scores 8.7 under CVSS 4.0). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is 0.35% (26th percentile), indicating low near-term exploitation likelihood.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
An authenticated attacker holding at least the resource administrator role on an F5 BIG-IP system can use the iHealth command to escape the tmsh restricted shell and obtain a full bash shell, a privilege escalation rated CVSS 4.0 8.5 (and CVSS 3.1 8.5, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). The impact is most severe on BIG-IP systems running in Appliance mode, where tmsh confinement is the enforced control and successful exploitation lets the attacker cross a security boundary; on systems not in Appliance mode the bash access is correspondingly less consequential. There is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low (0.39%, 31st percentile), making this an access-gated privilege-escalation issue rather than a mass-exploitation threat. Administered roles and the Appliance mode setting are the primary gating factors.
Undisclosed network traffic can crash the Traffic Management Microkernel (TMM) on F5 BIG-IP, the data-plane process responsible for handling all traffic on the device, resulting in a denial of service against the whole system. Exploitation requires a narrow, non-default configuration: a DTLS 1.2 virtual server with a Server SSL profile that has a certificate and key installed and the SSL Sign Hash set to ANY, plus a backend server enabled for DTLS 1.2 with client authentication; no authentication or user interaction is required against a device in that state, but other configurations are not affected. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is low at 0.24% (14th percentile), consistent with an availability-only flaw gated by a specific configuration rather than a broadly weaponizable one.
Denial of service in F5 BIG-IP Advanced WAF and BIG-IP ASM occurs when a Data Guard Protection Enforcement setting contains a URL longer than 1024 characters; the oversized input can cause the bd process to terminate repeatedly. Only deployments with a Data Guard-enabled WAF/ASM policy are affected-default BIG-IP configurations without such a policy are not exploitable-and the condition is introduced either manually by an administrator or automatically by Policy Builder learning an oversized URL from traffic. CVSS 4.0 score is 8.7 (availability-only, PR:N), while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit identified at time of analysis and EPSS is 0.35% (26th percentile); the provided Information Disclosure tag is inconsistent with the assessed availability-only impact.
Resource exhaustion in F5 BIG-IP and BIG-IP Next CNF DNS cache allows remote unauthenticated attackers to increase memory utilization on a DNS-caching virtual server, causing a high availability impact when malicious DNS queries are delivered. The flaw is only reachable when the non-default DNS cache feature is configured on a virtual server, and software versions past End of Technical Support were not evaluated. No public exploit was identified at time of analysis, CISA KEV status is not indicated, and EPSS is low at 0.35%.
Authenticated high-privilege users can exploit insufficient file path validation in the F5 BIG-IP Configuration utility to achieve high confidentiality and integrity impact within the management interface, though the flaw requires a network-reachable management session with elevated privileges. No public exploit code has been identified, and EPSS probability is low at 0.37% (29th percentile). The issue affects numerous BIG-IP modules as listed in the CPE, and End-of-Technical-Support versions were not evaluated, so unsupported builds cannot be assumed unaffected.
Privilege escalation in F5 BIG-IP lets an authenticated user who already holds at least the Resource Administrator role escalate to a higher privilege level by invoking an undisclosed iControl REST endpoint or TMOS Shell (tmsh) command that executes arbitrary operating-system commands, crossing a security boundary (scope changed, S:C). The flaw affects BIG-IP across essentially every licensed module (LTM, ASM, APM, AFM, Advanced WAF, Analytics, AVR, GTM, DNS, PEM, CGNAT, SSL Orchestrator, Container Ingress Services, and others) that share the underlying TMOS management plane; software versions past End of Technical Support were not evaluated by F5 and should be treated as potentially affected. Exploitation requires an authenticated session with administrative-tier access (PR:H), so the realistic attacker population is insiders or an adversary who has already compromised such an account - no public exploit code has been identified at time of analysis and EPSS is low (0.39%, 31st percentile), which is consistent with the high privilege prerequisite rather than a mass-exploitation scenario.
Stored cross-site scripting in the F5 BIG-IP Configuration utility lets an authenticated, high-privileged management user plant JavaScript that later executes in the browser session of any other administrator who loads the affected (undisclosed) page, enabling session-scoped data theft and privileged configuration actions under the victim's identity. Exploitation requires the attacker to already hold a privileged account on the management interface plus a second user to trigger the payload, and F5 hardening guidance assumes the Configuration utility is not internet-exposed. No public exploit code has been identified at time of analysis and EPSS is low at 0.28% (19th percentile), yet the vendor-assigned CVSS 4.0 base score of 8.4 (High) and the breadth of affected BIG-IP modules make this a meaningful risk for internet-reachable or weakly segmented management planes.
Unauthenticated remote attackers who can reach the BIG-IP Configuration utility (TMUI/management interface) can retrieve content from undisclosed endpoints that return static, non-sensitive information, resulting in a limited confidentiality exposure (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3, confidentiality-only, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.40% (33rd percentile), consistent with an information-disclosure issue whose practical risk is governed almost entirely by whether the management plane is exposed. The primary mitigation is F5's long-standing guidance to keep the Configuration utility on an isolated management network; organizations that do so have no general network reachability, making this a low-priority item despite the headline 6.9 score.
Denial of service in F5 BIG-IP Advanced WAF (the ASM module) and in NGINX with App Protect Bot Defense allows remote, unauthenticated attackers to disrupt new client requests by sending undisclosed specially crafted traffic through the inspection path. Only deployments that actively enable the affected feature are exposed - BIG-IP virtual servers with Server-Side Request Forgery (SSRF) protection turned on, or NGINX servers running App Protect Bot Defense - while impact is limited to availability, with no confidentiality or integrity effect. Risk is constrained by the low EPSS score (0.39%, 31st percentile) and there is no public exploit identified at time of analysis, but the low attack complexity and lack of required credentials mean exposed, feature-enabled edge devices should still be prioritized for patching.
Undisclosed crafted network traffic can corrupt or modify data handled by F5 BIG-IP when the affected flow uses a protocol that lacks message integrity protection, allowing an unauthenticated remote party to alter data without any confidentiality or availability impact. The issue affects BIG-IP broadly across the LTM, ASM/Advanced WAF, APM, AFM, GTM/DNS, CGNAT, Container Ingress Services and related module lines, and carries a CVSS 4.0 base score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VI:L), meaning exploitation is gated by attack prerequisites - the attacker must be able to inject traffic into a suitable integrity-less flow - rather than by authentication. Risk is moderate: EPSS is low at 0.25% (14th percentile), there is no KEV listing and no public exploit identified at time of analysis, so this is a hardening and integrity-assurance item rather than an emergency patch trigger.
Denial of service in F5 BIG-IP hardware platforms occurs when the High-Speed Bridge (HSB) locks up under specific undisclosed traffic conditions, though the trigger is non-deterministic and cannot be reliably forced by an attacker (high attack complexity). This affects BIG-IP hardware appliances containing HSB; software-only/virtual editions and End-of-Technical-Support versions are not affected. No authentication or user interaction is required, but no public exploit has been identified and EPSS score is 0.23% (low likelihood).
Denial of service in F5 BIG-IP's Traffic Management Microkernel (TMM) lets a remote, unauthenticated attacker crash the traffic-processing core by sending undisclosed crafted TCP/UDP traffic, but only on systems where the database variable tm.tcpudptxchecksum has been set to the non-default value 'Software-only'; default configurations are not affected. The root cause is a memory-corruption class defect (CWE-787, out-of-bounds write) in TMM's software checksum handling, rated 8.2 under the vendor's CVSS 4.0 vector, while independent assessment with CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) places it lower because the non-default checksum setting is a hard prerequisite (captured as AT:P in the 4.0 vector). EPSS is low (0.35%, 26th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Because TMM is shared across virtually every BIG-IP module, an affected appliance loses its data-plane forwarding capability each time TMM terminates.
Denial of service in F5 BIG-IP Advanced WAF and BIG-IP ASM can terminate the bd process when a Security Policy is bound to a virtual server and contains a JSON content profile whose JSON schema is malformed. Remote, unauthenticated attackers (CVSS 4.0 vector PR:N/UI:N, AV:N/AC:L) can send undisclosed requests that crash the process, producing an availability-only impact (VA:H with VC:N/VI:N) scored 8.7 by the vendor. Exploitation is gated by a non-default, erroneous configuration: only policies carrying a malformed JSON schema are affected, correctly formed JSON profiles and policies without JSON profiles are not, and End of Technical Support versions were not evaluated. EPSS is low at 0.35% (26th percentile), and there is no public exploit identified at time of analysis.
A directory traversal flaw in F5 BIG-IP's Traffic Management User Interface (TMUI) allows an already highly privileged, authenticated administrator of the management console to read files outside the intended directory scope on affected BIG-IP systems. The high-privilege prerequisite (PR:H in the vector) is the primary limiting factor: unauthenticated or low-privileged remote users cannot trigger the flaw, and the impact is confined to confidentiality (unauthorized file reads) with no stated integrity or availability effect. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation; EPSS sits at 1.19% (67th percentile), making this a moderate-priority hardening item rather than an emergency, though exposure rises if the TMUI management interface is internet-reachable or admin credentials are shared with lower-trust operators.
Appliance mode restrictions in F5 BIG-IP can be escaped by a highly privileged, authenticated administrator who already holds SCP and SFTP access to the device, allowing undisclosed commands to run outside the restricted shell that Appliance mode is designed to enforce. The flaw is a command-injection class issue (CWE-78) in the BIG-IP platform and affects the broad set of BIG-IP modules (APM, ASM/AWAF, AFM, Analytics, AAM, CGNAT, CIS, and others) only when the system is deliberately configured in Appliance mode - a non-default hardened lockdown state. Exploitation requires PR:H per the CVSS vector, meaning no unauthenticated or low-privileged path exists, and there is no public exploit identified at time of analysis; EPSS is low at 0.44% (37th percentile), and the CVE is not listed in CISA KEV. The net effect is a confidentiality and integrity impact (high C/I, no availability impact) for environments that tier a hardened Appliance-mode posture against trusted administrators.
Undisclosed network traffic can cause the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP devices that use the embedded Packet Velocity Acceleration (ePVA) feature on hardware containing an ePVA chip, resulting in a denial-of-service condition. This unauthenticated remote DoS (assessed CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects configurations using ePVA for virtual servers, NAT, or SNAT objects; devices without ePVA hardware or not using the feature are not exploitable. No public exploit identified at time of analysis, and the EPSS score is low (0.35%).
Remote unauthenticated attackers can cause a denial-of-service condition in F5 BIG-IP by sending undisclosed traffic to a virtual server configured with an iRule that uses the ILX::call command, resulting in termination of the Traffic Management Microkernel (TMM). This vulnerability, tracked as CVE-2025-53474, affects supported (non-EoTS) BIG-IP versions only when such a non-default iRule is present; devices without ILX::call-based iRules are not exploitable. No public exploit or active exploitation is known at time of analysis, and the EPSS score is low (0.35%, percentile 26%), though the CVSS 4.0 base score is 8.7 due to high availability impact.
A use-after-free (CWE-416) in F5 BIG-IP's Traffic Management Microkernel (TMM) allows remote unauthenticated attackers to crash the data-plane process when a TCP profile with Multipath TCP (MPTCP) explicitly enabled is applied to a virtual server. Only deployments with non-default MPTCP-enabled TCP profiles are exposed; successful triggering also depends on undisclosed traffic patterns and conditions beyond the attacker's control, so the crash cannot be forced reliably. Impact is availability-only (CVSS 4.0: 8.7, VA:H with VC:N/VI:N), no public exploit code or confirmed active exploitation is identified at time of analysis, and EPSS is low (~0.44%, 37th percentile).
Denial of service in F5 BIG-IP allows remote unauthenticated attackers to exhaust memory resources on virtual servers configured with an iRule containing the HTTP::respond command. The issue affects multiple BIG-IP modules and BIG-IP Next variants, excluding releases that have reached End of Technical Support, and successful exploitation only impacts availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and EPSS estimates a low exploitation likelihood of 0.43%.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authenticated attackers can inject system commands through crafted save operations, executing arbitrary code on the BIG-IP appliance which typically handles load balancing and SSL termination for critical application infrastructure.
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.