58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
F5 vulnerabilities
1039 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-41719 | MED 4.2 | f5 big-ip_next_central_manager When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.2% | — |
| CVE-2024-23306 | HIGH 7.1 | f5 big-ip_next_cloud-native_network_functions A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 0.2% | — |
| CVE-2022-41835 | HIGH 7.3 | f5 f5os-a In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller. | 0.2% | — |
| CVE-2023-43611 | HIGH 7.8 | f5 big-ip_access_policy_manager The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical | 0.1% | — |
| CVE-2023-38418 | HIGH 7.8 | f5 access_policy_manager_clients The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.1% | — |
| CVE-2025-23415 | LOW 3.1 | f5 big-ip_access_policy_manager An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN clien | 0.1% | — |
| CVE-2023-5450 | HIGH 7.3 | f5 big-ip_access_policy_manager An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) | 0.1% | — |
| CVE-2026-40703 | MED 5.4 | f5 big-ip_access_policy_manager A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.1% | — |
| CVE-2023-36858 | HIGH 7.1 | f5 access_policy_manager_clients An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluate | 0.1% | — |
| CVE-2025-53860 | MED 4.1 | f5 f5os-a A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems. Note: Software versions which have reached End of Technical Support (Eo | 0.1% | — |
| CVE-2025-48500 | HIGH 7.3 | f5 big-ip_access_policy_manager A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which ha | 0.1% | — |
| CVE-2026-42408 | MED 4.4 | f5 big-ip_access_policy_manager When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (Eo | 0.1% | — |
| CVE-2026-28758 | MED 4.4 | f5 big-ip_domain_name_system When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged | 0.1% | — |
| CVE-2026-20730 | LOW 3.3 | f5 big-ip_access_policy_manager A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 0.1% | — |