Skip to content
OpenAdvisories

Product · F5

BIG-IP

264 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-94127 Exploited Public exploit EPSS 27%

    BIG-IP APM OAuth vulnerability

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

    F5 BIG-IP Network devices
    KEV Sep 22, 2026
  • High 8.7
    CVE-2025-31644 Public exploit EPSS 24%

    Appliance mode BIG-IP iControl REST and tmsh vulnerability

    When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A …

    F5 BIG-IP Network devices
  • High 8.8
    CVE-2025-20029 Public exploit

    BIG-IP iControl REST and tmsh vulnerability

    Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are n…

    F5 BIG-IP Network devices
  • Critical 9.8
    CVE-2023-46747 Exploited · Ransomware Public exploit Scanner template EPSS 97%

    BIG-IP Configuration utility unauthenticated remote code execution vulnerability

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have …

    F5 BIG-IP Network devices
    KEV Oct 31, 2023
  • High 8.7
    CVE-2022-41800 Public exploit Scanner template EPSS 77%

    Appliance mode iControl REST vulnerability

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to…

    F5 BIG-IP Network devices
  • High 8.8
    CVE-2022-41622 Public exploit EPSS 92%

    iControl SOAP vulnerability

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IQ Centralized Management Network devices
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022