Skip to content
OpenAdvisories

Vendor

F5

432 known vulnerabilities.

Products

BIG-IP 259 NGINX Plus 37 NGINX Open Source 35 BIG-IP Next CNF 26 BIG-IP Next SPK 23 BIG-IQ 20 BIG-IP Next for Kubernetes 13 BIG-IP APM 12 F5OS - Appliance 12 BIG-IP Edge Client 11 F5OS - Chassis 10 BIG-IP Next Central Manager 9 NGINX Ingress Controller 8 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 8 BIG-IQ Centralized Management 7 NGINX JavaScript 6 NGINX Gateway Fabric 6 NGINX Instance Manager 5 BIG-IP ASM 4 BIG-IP Next 4 BIG-IP (AFM) 4 BIG-IP Guided Configuration (GC) 4 F5OS-A 4 NGINX Agent 3 BIG-IP Advanced WAF & ASM 3 F5 Access 3 SSL Orchestrator 3 BIG-IP SPK 3 BIG-IP APM Clients 3 NGINX API Connectivity Manager 3 F5OS-C 3 BIG-IP DNS 2 APM Clients 2 NGINX 2 NGINX Open Source Subscription 2 BIG-IP (AFM, PEM) 2 F5 SSL Orchestrator 2 Traffix SDC 2 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager 2 BIG-IP (Advanced WAF, APM, ASM) 2
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-94127 Exploited Public exploit EPSS 27%

    BIG-IP APM OAuth vulnerability

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

    F5 BIG-IP Network devices
    KEV Sep 22, 2026
  • Critical 9.8
    CVE-2025-53521 Exploited

    BigIP APM Vulnerability

    When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
    KEV Mar 27, 2026
  • High 8.8
    CVE-2023-46748 Exploited

    BIG-IP Configuration utility authenticated SQL injection vulnerability

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary…

    F5 BIG-IP Network devices
    KEV Oct 31, 2023
  • Critical 9.8
    CVE-2023-46747 Exploited · Ransomware Public exploit EPSS 97%

    BIG-IP Configuration utility unauthenticated remote code execution vulnerability

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have …

    F5 BIG-IP Network devices
    KEV Oct 31, 2023
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022