F5
643 CVEs across 343 F5 products. Browse F5 vulnerabilities, severities, and proof-of-concept exploits.
F5 products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60005 | High | 8.2 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured o… |
CVE-2026-60065 | Low | 3.7 | 2026-07-15 | When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers ca… |
CVE-2026-60062 | Medium | 6.4 | 2026-07-15 | The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure director… |
CVE-2026-59762 | High | 7.5 | 2026-07-15 | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System… |
CVE-2026-56434 | Medium | 6.5 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), prox… |
CVE-2026-55723 | High | 8.3 | 2026-07-15 | When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configurat… |
CVE-2026-52865 | Medium | 6.5 | 2026-07-15 | When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or… |
CVE-2026-42533 | High | 8.1 | 2026-07-15 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… |
CVE-2026-50107 | High | 8.1 | 2026-06-17 | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration gen… |
CVE-2026-32682 | Medium | 6.5 | 2026-06-17 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause t… |
CVE-2026-48142 | Medium | 4.8 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with bo… |
CVE-2026-42530 | High | 8.1 | 2026-06-17 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenti… |
CVE-2026-42055 | High | 8.1 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the prox… |
CVE-2026-11311 | High | 8.1 | 2026-06-17 | When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of N… |
CVE-2026-49975 | High | 7.5 | 2026-06-08 | Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue… |
CVE-2026-9256 | High | 8.1 | 2026-05-22 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pa… |
CVE-2026-8711 | High | 8.1 | 2026-05-19 | NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*… |
CVE-2026-42946 | Medium | 6.5 | 2026-05-13 | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. Wh… |
CVE-2026-42945 | High | 8.1 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed b… |
CVE-2026-42937 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabi… |
CVE-2026-42934 | Medium | 4.8 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with… |
CVE-2026-42930 | High | 8.7 | 2026-05-13 | When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP syste… |
CVE-2026-42926 | Medium | 5.8 | 2026-05-13 | When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to injec… |
CVE-2026-42924 | High | 8.7 | 2026-05-13 | An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privil… |
CVE-2026-42920 | High | 7.5 | 2026-05-13 | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microker… |
CVE-2026-42919 | Medium | 6.7 | 2026-05-13 | A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit… |
CVE-2026-42781 | Medium | 6.5 | 2026-05-13 | When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Mana… |
CVE-2026-42780 | Medium | 4.9 | 2026-05-13 | A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt… |
CVE-2026-42409 | High | 7.5 | 2026-05-13 | When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause t… |
CVE-2026-42408 | Medium | 4.4 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to… |
CVE-2026-42406 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify con… |
CVE-2026-42063 | Medium | 4.9 | 2026-05-13 | A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. No… |
CVE-2026-42058 | Medium | 4.3 | 2026-05-13 | An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software ve… |
CVE-2026-41959 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vu… |
CVE-2026-41957 | High | 8.8 | 2026-05-13 | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versio… |
CVE-2026-41956 | High | 7.5 | 2026-05-13 | When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Not… |
CVE-2026-41954 | Medium | 4.9 | 2026-05-13 | Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated… |
CVE-2026-41953 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configurati… |
CVE-2026-41227 | High | 7.5 | 2026-05-13 | On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Man… |
CVE-2026-41225 | Critical | 9.1 | 2026-05-13 | A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that… |
CVE-2026-41219 | Medium | 6.5 | 2026-05-13 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView fi… |
CVE-2026-41218 | High | 7.5 | 2026-05-13 | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery… |
CVE-2026-41217 | High | 7.9 | 2026-05-13 | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator… |
CVE-2026-40703 | Medium | 5.4 | 2026-05-13 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End… |
CVE-2026-40701 | Medium | 4.8 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and… |
CVE-2026-40699 | Medium | 6.5 | 2026-05-13 | A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed se… |
CVE-2026-40698 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create… |
CVE-2026-40631 | High | 8.7 | 2026-05-13 | An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege e… |
CVE-2026-40629 | High | 7.5 | 2026-05-13 | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Softwa… |
CVE-2026-40618 | High | 7.5 | 2026-05-13 | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms… |
CVE-2026-40462 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to v… |
CVE-2026-40460 | Medium | 6.5 | 2026-05-13 | When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass… |
CVE-2026-40435 | Medium | 5.3 | 2026-05-13 | When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software version… |
CVE-2026-40423 | High | 7.5 | 2026-05-13 | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software ver… |
CVE-2026-40067 | High | 7.5 | 2026-05-13 | When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which… |
CVE-2026-40061 | High | 8.7 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated att… |
CVE-2026-40060 | High | 7.5 | 2026-05-13 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: So… |
CVE-2026-39459 | High | 7.2 | 2026-05-13 | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create c… |
CVE-2026-39458 | High | 7.5 | 2026-05-13 | When a BIG-IP DNS profile enabled with DNS cache is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to t… |
CVE-2026-39455 | High | 7.5 | 2026-05-13 | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd… |
CVE-2026-35062 | Medium | 6.5 | 2026-05-13 | An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support… |
CVE-2026-34176 | High | 8.7 | 2026-05-13 | When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit c… |
CVE-2026-34019 | Medium | 5.3 | 2026-05-13 | When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Micro… |
CVE-2026-32673 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute ar… |
CVE-2026-32643 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify con… |
CVE-2026-28758 | Medium | 4.4 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext… |
CVE-2026-24464 | Medium | 6.8 | 2026-05-13 | When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker wi… |
CVE-2026-20916 | High | 8.1 | 2026-05-13 | An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system… |
CVE-2026-32647 | High | 7.8 | 2026-03-24 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-wr… |
CVE-2026-28755 | Medium | 5.4 | 2026-03-24 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured… |
CVE-2026-28753 | Low | 3.7 | 2026-03-24 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This… |
CVE-2026-27784 | High | 7.8 | 2026-03-24 | The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write… |
CVE-2026-27654 | High | 8.2 | 2026-03-24 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX… |
CVE-2026-27651 | High | 7.5 | 2026-03-24 | When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This iss… |
CVE-2026-2507 | High | 7.5 | 2026-02-18 | When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Sup… |
CVE-2026-22549 | Medium | 4.9 | 2026-02-04 | A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which hav… |
CVE-2026-22548 | Medium | 5.9 | 2026-02-04 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control c… |
CVE-2026-20732 | Low | 3.1 | 2026-02-04 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which h… |
CVE-2026-20730 | Low | 3.3 | 2026-02-04 | A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Softwa… |
CVE-2026-1642 | Medium | 5.9 | 2026-02-04 | A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-m… |
CVE-2025-14727 | High | 8.3 | 2025-12-17 | A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Techn… |
CVE-2025-61990 | High | 7.5 | 2025-10-15 | When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Softwa… |
CVE-2025-61935 | High | 7.5 | 2025-10-15 | When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Softwar… |
CVE-2025-61933 | Medium | 6.1 | 2025-10-15 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of th… |
CVE-2025-58071 | High | 7.5 | 2025-10-15 | When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions wh… |
CVE-2025-57780 | High | 8.8 | 2025-10-15 | A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful explo… |
CVE-2025-53860 | Medium | 4.1 | 2025-10-15 | A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) inform… |
CVE-2025-61974 | High | 7.5 | 2025-10-15 | When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software version… |
CVE-2025-61960 | High | 7.5 | 2025-10-15 | When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to… |
CVE-2025-61958 | High | 8.7 | 2025-10-15 | A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions… |
CVE-2025-61955 | High | 8.8 | 2025-10-15 | A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful expl… |
CVE-2025-61951 | High | 7.5 | 2025-10-15 | Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2… |
CVE-2025-61938 | High | 7.5 | 2025-10-15 | When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement set… |
CVE-2025-60016 | High | 7.5 | 2025-10-15 | When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that prof… |
CVE-2025-60015 | Medium | 5.7 | 2025-10-15 | An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of… |
CVE-2025-60013 | Medium | 4.6 | 2025-10-15 | When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary s… |
CVE-2025-59781 | High | 7.5 | 2025-10-15 | When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Not… |
CVE-2025-59778 | High | 7.5 | 2025-10-15 | When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. N… |
CVE-2025-59483 | Medium | 6.5 | 2025-10-15 | A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoT… |
CVE-2025-59481 | High | 8.7 | 2025-10-15 | A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource adm… |