Skip to content
OpenAdvisories

Vendor

F5

586 known vulnerabilities.

Products

BIG-IP 264 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 38 NGINX Plus 37 NGINX Open Source 35 BIG-IP APM 31 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe) 28 BIG-IP Next CNF 26 BIG-IP Next SPK 23 BIG-IQ 20 BIG-IP Next for Kubernetes 13 BIG-IP Edge Client 12 F5OS - Appliance 12 BIG-IP ASM 10 BIG-IQ Centralized Management 10 F5OS - Chassis 10 BIG-IP Next Central Manager 9 NGINX Ingress Controller 8 BIG-IP (AFM) 8 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe 7 NGINX JavaScript 6 NGINX Gateway Fabric 6 NGINX Instance Manager 5 Enterprise Manager 5 BIG-IP Next 4 BIG-IP APM Clients 4 F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe 4 BIG-IP Guided Configuration (GC) 4 BIG-IP PEM 4 F5OS-A 4 NGINX Agent 3 BIG-IP DNS 3 BIG-IP Advanced WAF & ASM 3 IWorkflow 3 F5 Access 3 SSL Orchestrator 3 BIG-IP SPK 3 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, Websafe 3 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe 3 NGINX API Connectivity Manager 3 F5OS-C 3
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-94127 Exploited Public exploit EPSS 27%

    BIG-IP APM OAuth vulnerability

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

    F5 BIG-IP Network devices
    KEV Sep 22, 2026
  • Critical 9.1
    CVE-2026-41225

    iControl REST vulnerability

    A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Suppo…

    F5 BIG-IP Network devices
  • Critical 9.8
    CVE-2025-53521 Exploited

    BigIP APM Vulnerability

    When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
    KEV Mar 27, 2026
  • Critical 9.8
    CVE-2023-46747 Exploited · Ransomware Public exploit Scanner template EPSS 97%

    BIG-IP Configuration utility unauthenticated remote code execution vulnerability

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have …

    F5 BIG-IP Network devices
    KEV Oct 31, 2023
  • Critical 9.9
    CVE-2023-41373

    BIG-IP Configuration Utility vulnerability

    A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross…

    F5 BIG-IP Network devices
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022